Edit tour

Windows Analysis Report
all the necessary information.scr

Overview

General Information

Sample name:	all the necessary information.scr
Analysis ID:	1355302
MD5:	df5ac38d7bc0233a2775fe6a54db880a
SHA1:	b5e261d8e49ce7f6170e270de1a1f875333dfdca
SHA256:	99e11573d54e8379e7fc2d5b2233764cef0b4f6a910ddca9df64e8aa09c3822c
Infos:

Detection

Vidar

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	47
Range:	0 - 100

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

all the necessary information.scr (PID: 6496 cmdline: "C:\Users\user\Desktop\all the necessary information.scr" /S MD5: DF5AC38D7BC0233A2775FE6A54DB880A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199577999137", "https://t.me/redcarsc"], "Botnet": "e4dee63026d7a45f71e722a28e306835", "Version": "6.8"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1331728696.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: all the necessary information.scr PID: 6496	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: all the necessary information.scr PID: 6496	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: all the necessary information.scr PID: 6496	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.all the necessary information.scr.2a510000.0.raw.unpack

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199577999137", "https://t.me/redcarsc"], "Botnet": "e4dee63026d7a45f71e722a28e306835", "Version": "6.8"}

Multi AV Scanner detection for submitted file

Source: all the necessary information.scr

ReversingLabs: Detection: 21%

Cryptography

Source: all the necessary information.scr, 00000000.00000000.1331728696.0000000000416000.00000020.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_9d0ce2fd-b

Compliance

Uses 32bit PE files

Source: all the necessary information.scr

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

PE / OLE file has a valid certificate

Source: all the necessary information.scr

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49702 version: TLS 1.2

Binary contains paths to debug symbols

Source:	Binary string: wntdll.pdbUGP source: all the necessary information.scr, 00000000.00000002.1671941236.000000002A6A0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: all the necessary information.scr, 00000000.00000002.1671941236.000000002A6A0000.00000040.00001000.00020000.00000000.sdmp

Spreading

Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199577999137
Source: Malware configuration extractor	URLs: https://t.me/redcarsc

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.7:49703 -> 116.202.183.33:25565

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /redcarsc HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 116.202.183.33 116.202.183.33
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.183.33

Source: global traffic

HTTP traffic detected: GET /redcarsc HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: t.me

Source: all the necessary information.scr	String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: all the necessary information.scr	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_
Source: all the necessary information.scr	String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: all the necessary information.scr	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: all the necessary information.scr	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: all the necessary information.scr	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: all the necessary information.scr, 00000000.00000002.1669874156.0000000028710000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: all the necessary information.scr, 00000000.00000003.1441372122.00000000287B3000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000003.1481977492.0000000028781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?65d6e8d072e9f
Source: all the necessary information.scr, 00000000.00000002.1669874156.0000000028710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enI
Source: all the necessary information.scr	String found in binary or memory: http://ocsps.ssl.com0
Source: all the necessary information.scr	String found in binary or memory: http://ocsps.ssl.com0?
Source: all the necessary information.scr, 00000000.00000003.1430749832.0000000028766000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000003.1481977492.0000000028781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: all the necessary information.scr	String found in binary or memory: http://www.openswatchbook.org/uri/2009/osb
Source: all the necessary information.scr, 00000000.00000002.1675739788.000000002BD78000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, sqlite3[1].dll.0.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: all the necessary information.scr	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: all the necessary information.scr	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: all the necessary information.scr, 00000000.00000003.1481977492.0000000028772000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1669874156.0000000028772000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33/
Source: all the necessary information.scr, 00000000.00000002.1669874156.0000000028710000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1672973105.000000002A9D7000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/$t
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/%
Source: all the necessary information.scr, 00000000.00000003.1481977492.0000000028769000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/(
Source: all the necessary information.scr, 00000000.00000003.1481794496.000000002B760000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/0Qy
Source: all the necessary information.scr, 00000000.00000003.1481794496.000000002B760000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/:081.SF
Source: all the necessary information.scr, 00000000.00000003.1481794496.000000002B760000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/?Qt
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/Authority
Source: all the necessary information.scr, 00000000.00000002.1669874156.00000000286C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/E
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/FHJKFCGIEBGIIJDdQ
Source: all the necessary information.scr, 00000000.00000002.1669874156.000000002879A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/M
Source: all the necessary information.scr, 00000000.00000002.1669874156.00000000286C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/a
Source: all the necessary information.scr, 00000000.00000003.1481977492.0000000028769000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/bM
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/cruntime140.dll~Q
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B7A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/freebl3.dll
Source: all the necessary information.scr, 00000000.00000002.1669874156.00000000286C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/freebl3.dll%
Source: all the necessary information.scr, 00000000.00000003.1481866655.000000002879D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/g
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B7A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/mozglue.dll
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B7A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/mozglue.dll5
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B7A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/msvcp140.dll
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B768000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1669874156.0000000028781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/nss3.dll
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B768000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/nss3.dllCw
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B7A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/softokn3.dll
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B7A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/softokn3.dllI
Source: all the necessary information.scr, 00000000.00000002.1669874156.0000000028710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/sqlite3.dll
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/vcruntime140.dll
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/vcruntime140.dll?Qt
Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565/vcruntime140.dlll0Qy
Source: all the necessary information.scr, 00000000.00000002.1672973105.000000002A9D7000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565ne
Source: all the necessary information.scr, 00000000.00000002.1672973105.000000002AA15000.00000040.00001000.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1672973105.000000002A9D7000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565ontent-Disposition:
Source: all the necessary information.scr, 00000000.00000003.1481977492.0000000028772000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.183.33:25565x(
Source: IDBAKKEC.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: IDBAKKEC.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: IDBAKKEC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: IDBAKKEC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: all the necessary information.scr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/)
Source: IDBAKKEC.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: IDBAKKEC.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: IDBAKKEC.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: all the necessary information.scr, 00000000.00000002.1671689348.000000002A510000.00000004.00001000.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1672973105.000000002A951000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199577999137
Source: all the necessary information.scr, 00000000.00000002.1671689348.000000002A510000.00000004.00001000.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1672973105.000000002A951000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199577999137sp77d
Source: all the necessary information.scr, 00000000.00000002.1669874156.0000000028710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: all the necessary information.scr, 00000000.00000002.1669874156.0000000028710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/K
Source: all the necessary information.scr, 00000000.00000002.1671633048.000000002A4F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/red
Source: all the necessary information.scr, 00000000.00000002.1669874156.0000000028710000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1672973105.000000002A951000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/redcarsc
Source: all the necessary information.scr, 00000000.00000002.1671689348.000000002A510000.00000004.00001000.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1672973105.000000002A951000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/redcarscsp77dMozilla/5.0
Source: all the necessary information.scr, 00000000.00000003.1430749832.0000000028766000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1669874156.0000000028710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: all the necessary information.scr	String found in binary or memory: https://www.abyssmedia.com/
Source: all the necessary information.scr	String found in binary or memory: https://www.abyssmedia.com/audioretoucher/audioretoucher.xml
Source: all the necessary information.scr	String found in binary or memory: https://www.abyssmedia.com/audioretoucher/open
Source: all the necessary information.scr	String found in binary or memory: https://www.abyssmedia.com/downloads/audioretoucher.exe
Source: all the necessary information.scr	String found in binary or memory: https://www.abyssmedia.com/order.shtml?ref=AudioRetoucheropenSV
Source: all the necessary information.scr	String found in binary or memory: https://www.abyssmedia.com/order.shtml?ref=audioretoucheropen
Source: all the necessary information.scr	String found in binary or memory: https://www.abyssmedia.com/pad/getpad.php?pad=
Source: IDBAKKEC.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: IDBAKKEC.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: all the necessary information.scr	String found in binary or memory: https://www.ssl.com/repository0

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49702 version: TLS 1.2

System Summary

Detected potential crypto function

Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E88FCA	0_2_61E88FCA
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61EAD2AC	0_2_61EAD2AC
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E4B8A1	0_2_61E4B8A1
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E75F1F	0_2_61E75F1F
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E40065	0_2_61E40065
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E9E24F	0_2_61E9E24F
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E5023C	0_2_61E5023C
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E62554	0_2_61E62554
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E4E4BF	0_2_61E4E4BF
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E94783	0_2_61E94783
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E7A790	0_2_61E7A790
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E18736	0_2_61E18736
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E86668	0_2_61E86668
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E58670	0_2_61E58670
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E10856	0_2_61E10856
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61EA0BA9	0_2_61EA0BA9
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E62CA3	0_2_61E62CA3
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E98FE2	0_2_61E98FE2
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E52F80	0_2_61E52F80
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61EA2F47	0_2_61EA2F47
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E56F18	0_2_61E56F18
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E4CEF9	0_2_61E4CEF9
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E1EEFF	0_2_61E1EEFF
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E64E0C	0_2_61E64E0C
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61EA91F6	0_2_61EA91F6
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E9316A	0_2_61E9316A
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E9F0ED	0_2_61E9F0ED
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61EA70CF	0_2_61EA70CF
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E9D0C3	0_2_61E9D0C3
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E8D0B6	0_2_61E8D0B6
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E6904E	0_2_61E6904E
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E4304E	0_2_61E4304E
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E15337	0_2_61E15337
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E19208	0_2_61E19208
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E534E3	0_2_61E534E3
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E77452	0_2_61E77452
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E37930	0_2_61E37930
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E7B85E	0_2_61E7B85E
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E21816	0_2_61E21816
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E9FBF0	0_2_61E9FBF0
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E55BD7	0_2_61E55BD7
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61EA5B62	0_2_61EA5B62
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E91DC1	0_2_61E91DC1
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E6DDA5	0_2_61E6DDA5
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E31DAB	0_2_61E31DAB
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E95D7A	0_2_61E95D7A
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E25FA2	0_2_61E25FA2
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E1DEC2	0_2_61E1DEC2
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E69E8F	0_2_61E69E8F
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E89E0E	0_2_61E89E0E

PE file contains more sections than normal

Source: all the necessary information.scr	Static PE information: Number of sections : 12 > 10
Source: sqlite3[1].dll.0.dr	Static PE information: Number of sections : 18 > 10

Sample file is different than original file name gathered from version info

Source: all the necessary information.scr, 00000000.00000002.1671941236.000000002A7CD000.00000040.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamentdll.dllj% vs all the necessary information.scr

Tries to load missing DLLs

Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: libflac.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: nss3.dll	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Section loaded: windowscodecs.dll	Jump to behavior

Uses 32bit PE files

Source: all the necessary information.scr

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal92.troj.spyw.evad.winSCR@1/11@1/2

Source: C:\Users\user\Desktop\all the necessary information.scr

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\O7YP6MB0.htm

Jump to behavior

Source: Yara match

File source: 00000000.00000000.1331728696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\all the necessary information.scr	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\all the necessary information.scr

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: all the necessary information.scr, 00000000.00000002.1675739788.000000002BD78000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, sqlite3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: all the necessary information.scr, 00000000.00000002.1675739788.000000002BD78000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, sqlite3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: all the necessary information.scr, 00000000.00000002.1675739788.000000002BD78000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, sqlite3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: all the necessary information.scr, 00000000.00000002.1675739788.000000002BD78000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, sqlite3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: all the necessary information.scr, 00000000.00000002.1675739788.000000002BD78000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, sqlite3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: all the necessary information.scr, 00000000.00000002.1675739788.000000002BD78000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, sqlite3[1].dll.0.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: all the necessary information.scr, 00000000.00000002.1675739788.000000002BD78000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, sqlite3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: all the necessary information.scr, 00000000.00000003.1545479215.000000002BC8B000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000003.1557976684.000000002BCA9000.00000004.00000020.00020000.00000000.sdmp, AKFIDHDGIEGCAKFIIJKF.0.dr, KJJJJDHIDBGHIDHIDAFB.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: all the necessary information.scr, 00000000.00000002.1675739788.000000002BD78000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, sqlite3[1].dll.0.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: all the necessary information.scr, 00000000.00000002.1675739788.000000002BD78000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, sqlite3[1].dll.0.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: all the necessary information.scr

ReversingLabs: Detection: 21%

Source: C:\Users\user\Desktop\all the necessary information.scr

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

PE / OLE file has a valid certificate

Source: all the necessary information.scr

Static PE information: certificate valid

PE file has a big code size

Source: all the necessary information.scr

Static PE information: Virtual size of .text is bigger than: 0x100000

Submission file is bigger than most known malware samples

Source: all the necessary information.scr

Static file information: File size 672236584 > 1048576

PE file has a big raw section

Source: all the necessary information.scr	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x22d200
Source: all the necessary information.scr	Static PE information: Raw size of Earqtput is bigger than: 0x100000 < 0x27e79600

Binary contains paths to debug symbols

Source:	Binary string: wntdll.pdbUGP source: all the necessary information.scr, 00000000.00000002.1671941236.000000002A6A0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: all the necessary information.scr, 00000000.00000002.1671941236.000000002A6A0000.00000040.00001000.00020000.00000000.sdmp

Data Obfuscation

PE file contains sections with non-standard names

Source: all the necessary information.scr	Static PE information: section name: .didata
Source: all the necessary information.scr	Static PE information: section name: Earqtput
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /4
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /19
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /31
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /45
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /57
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /70
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /81
Source: sqlite3[1].dll.0.dr	Static PE information: section name: /92

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A221A37 push dword ptr [esp+04h]; retn 0008h	0_2_2A221A09
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A221A11 push dword ptr [esp+04h]; retn 0008h	0_2_2A221A09
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A221A55 push dword ptr [esp+04h]; retn 0008h	0_2_2A221A09
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A223824 push bp; mov dword ptr [esp], eax	0_2_2A22387B
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A22383F push bp; mov dword ptr [esp], eax	0_2_2A22387B
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A223845 push bp; mov dword ptr [esp], eax	0_2_2A22387B
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A2238C7 push bp; mov dword ptr [esp], eax	0_2_2A22387B
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A225917 push word ptr [esp+09h]; mov dword ptr [esp], esp	0_2_2A22595E
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A2219AB push dword ptr [esp+04h]; retn 0008h	0_2_2A221A09
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A2219BB push dword ptr [esp+04h]; retn 0008h	0_2_2A221A09
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A22199A push dword ptr [esp+04h]; retn 0008h	0_2_2A221A09
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A2219F6 push dword ptr [esp+04h]; retn 0008h	0_2_2A221A09
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A222F59 push dword ptr [esp+04h]; mov dword ptr [esp], esp	0_2_2A222F69
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A222F5D push dword ptr [esp+04h]; mov dword ptr [esp], esp	0_2_2A222F69
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A225D29 push word ptr [esp+03h]; mov dword ptr [esp], ecx	0_2_2A225CFD
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A225D31 pushfd ; mov dword ptr [esp], ecx	0_2_2A225D6D
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A225D5E pushfd ; mov dword ptr [esp], ecx	0_2_2A225D6D
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A223379 push ebp; mov dword ptr [esp], edi	0_2_2A223397
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A22561D push dword ptr [esp+10h]; retn 0014h	0_2_2A22565D
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A221664 push 245C4079h; iretd	0_2_2A221669
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A225668 push dword ptr [esp+24h]; retn 0028h	0_2_2A2256BA
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A22165A pushfd ; mov dword ptr [esp], ebp	0_2_2A2215ED
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A221658 pushfd ; mov dword ptr [esp], ebp	0_2_2A2215ED
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A2256A5 push dword ptr [esp+24h]; retn 0028h	0_2_2A2256BA
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A2216B1 pushfd ; mov dword ptr [esp], ebp	0_2_2A2215ED
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A2256BE push dword ptr [esp+24h]; retn 0028h	0_2_2A2256BA
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A225691 push dword ptr [esp+24h]; retn 0028h	0_2_2A2256BA
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A221694 pushfd ; mov dword ptr [esp], ebp	0_2_2A2215ED
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A2216E3 pushfd ; mov dword ptr [esp], ebp	0_2_2A2215ED
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A2256C5 push dword ptr [esp+24h]; retn 0028h	0_2_2A2256BA
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A2256D4 push dword ptr [esp+30h]; retn 0034h	0_2_2A22574C

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\all the necessary information.scr

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\sqlite3[1].dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\all the necessary information.scr	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\all the necessary information.scr	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: all the necessary information.scr PID: 6496, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: all the necessary information.scr, 00000000.00000002.1672973105.000000002A951000.00000040.00001000.00020000.00000000.sdmp

Binary or memory string: !"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/AVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\all the necessary information.scr

Code function: 0_2_2A222F9E rdtsc

0_2_2A222F9E

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\all the necessary information.scr

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\sqlite3[1].dll

Jump to dropped file

Found large amount of non-executed APIs

Source: C:\Users\user\Desktop\all the necessary information.scr

API coverage: 2.2 %

Queries keyboard layouts

Source: C:\Users\user\Desktop\all the necessary information.scr	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809			Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809			Jump to behavior

Source: C:\Users\user\Desktop\all the necessary information.scr

Code function: 0_2_61E354D1 sqlite3_os_init,GetSystemInfo,

0_2_61E354D1

Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: KJEHCGDB.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: KJEHCGDB.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: KJEHCGDB.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: KJEHCGDB.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: KJEHCGDB.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: KJEHCGDB.0.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: KJEHCGDB.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: KJEHCGDB.0.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: KJEHCGDB.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: KJEHCGDB.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: all the necessary information.scr, 00000000.00000002.1669874156.00000000286C8000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1669874156.0000000028737000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: KJEHCGDB.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: KJEHCGDB.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: KJEHCGDB.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: KJEHCGDB.0.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: KJEHCGDB.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: KJEHCGDB.0.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: KJEHCGDB.0.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: all the necessary information.scr, 00000000.00000002.1669874156.0000000028737000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWZ
Source: KJEHCGDB.0.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: KJEHCGDB.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: KJEHCGDB.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: KJEHCGDB.0.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: KJEHCGDB.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: KJEHCGDB.0.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: all the necessary information.scr, 00000000.00000002.1669874156.00000000286C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: KJEHCGDB.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: KJEHCGDB.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: KJEHCGDB.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: KJEHCGDB.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: KJEHCGDB.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: KJEHCGDB.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: KJEHCGDB.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: KJEHCGDB.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\all the necessary information.scr

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\all the necessary information.scr

Code function: 0_2_2A222F9E rdtsc

0_2_2A222F9E

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A225ACD mov edx, dword ptr fs:[00000030h]	0_2_2A225ACD
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A225B15 mov eax, dword ptr fs:[00000030h]	0_2_2A225B15
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A225B72 mov eax, dword ptr fs:[00000030h]	0_2_2A225B72
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A22235C mov ebx, dword ptr fs:[00000030h]	0_2_2A22235C
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A2233C8 mov eax, dword ptr fs:[00000030h]	0_2_2A2233C8
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A2210F9 mov edx, dword ptr fs:[00000030h]	0_2_2A2210F9
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A222716 mov edx, dword ptr fs:[00000030h]	0_2_2A222716
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_2A226480 mov eax, dword ptr fs:[00000030h]	0_2_2A226480

Source: C:\Users\user\Desktop\all the necessary information.scr

Code function: 0_2_61EAF900 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,

0_2_61EAF900

Source: C:\Users\user\Desktop\all the necessary information.scr

Memory protected: page guard

Jump to behavior

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\all the necessary information.scr	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\all the necessary information.scr

Code function: 0_2_61EAF850 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_61EAF850

Lowering of HIPS / PFW / Operating System Security Settings

AV process strings found (often used to terminate AV products)

Source: all the necessary information.scr, 00000000.00000002.1674384182.000000002B768000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\Desktop\all the necessary information.scr

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: all the necessary information.scr PID: 6496, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: all the necessary information.scr	String found in binary or memory: wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exo
Source: all the necessary information.scr	String found in binary or memory: \ElectronCash\wallets\
Source: all the necessary information.scr	String found in binary or memory: wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exo
Source: all the necessary information.scr	String found in binary or memory: Jaxx Desktop (old)
Source: all the necessary information.scr	String found in binary or memory: wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exo
Source: all the necessary information.scr	String found in binary or memory: wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exo
Source: all the necessary information.scr	String found in binary or memory: \Exodus\exodus.wallet\
Source: all the necessary information.scr	String found in binary or memory: info.seco
Source: all the necessary information.scr	String found in binary or memory: wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exo
Source: all the necessary information.scr	String found in binary or memory: \jaxx\Local Storage\
Source: all the necessary information.scr	String found in binary or memory: passphrase.json
Source: all the necessary information.scr	String found in binary or memory: wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exo
Source: all the necessary information.scr	String found in binary or memory: \Exodus\exodus.wallet\
Source: all the necessary information.scr	String found in binary or memory: sktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|B
Source: all the necessary information.scr	String found in binary or memory: wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exo
Source: all the necessary information.scr	String found in binary or memory: MultiDoge
Source: all the necessary information.scr	String found in binary or memory: \Exodus\exodus.wallet\
Source: all the necessary information.scr	String found in binary or memory: seed.seco
Source: all the necessary information.scr	String found in binary or memory: wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exo
Source: all the necessary information.scr	String found in binary or memory: wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exo

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\all the necessary information.scr	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\all the necessary information.scr

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Yara detected Credential Stealer

Source: Yara match

File source: Process Memory Space: all the necessary information.scr PID: 6496, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: all the necessary information.scr PID: 6496, type: MEMORYSTR

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E1307A sqlite3_transfer_bindings,	0_2_61E1307A
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E2D5E6 sqlite3_bind_int64,	0_2_61E2D5E6
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E2D595 sqlite3_bind_double,	0_2_61E2D595
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E0B431 sqlite3_clear_bindings,	0_2_61E0B431
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E037F3 sqlite3_value_frombind,	0_2_61E037F3
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E2D781 sqlite3_bind_zeroblob64,	0_2_61E2D781
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E2D714 sqlite3_bind_zeroblob,	0_2_61E2D714
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E2D68C sqlite3_bind_pointer,	0_2_61E2D68C
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E2D65B sqlite3_bind_null,	0_2_61E2D65B
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E2D635 sqlite3_bind_int,	0_2_61E2D635
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E2D9B0 sqlite3_bind_value,	0_2_61E2D9B0
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E2D981 sqlite3_bind_text16,	0_2_61E2D981
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E2D945 sqlite3_bind_text64,	0_2_61E2D945
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E2D916 sqlite3_bind_text,	0_2_61E2D916
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E2D8E7 sqlite3_bind_blob64,	0_2_61E2D8E7
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E038CA sqlite3_bind_parameter_count,	0_2_61E038CA
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E158CA sqlite3_bind_parameter_index,	0_2_61E158CA
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E038DC sqlite3_bind_parameter_name,	0_2_61E038DC
Source: C:\Users\user\Desktop\all the necessary information.scr	Code function: 0_2_61E2D8B8 sqlite3_bind_blob,	0_2_61E2D8B8

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Query Registry	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	131 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Ingress Tool Transfer			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	2 Non-Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Scheduled Transfer	13 Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
all the necessary information.scr	22%	ReversingLabs	Win32.Trojan.Vidar

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\sqlite3[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://ocsps.ssl.com0?	0%	URL Reputation	safe
http://ocsps.ssl.com0	0%	URL Reputation	safe
http://www.microsoft.c	0%	URL Reputation	safe
https://116.202.183.33:25565/mozglue.dll5	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/(	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/bM	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/vcruntime140.dll	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/softokn3.dll	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/freebl3.dll	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/sqlite3.dll	0%	Avira URL Cloud	safe
https://www.abyssmedia.com/	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/freebl3.dll%	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/%	0%	Avira URL Cloud	safe
https://116.202.183.33:25565x(	0%	Avira URL Cloud	safe
https://www.abyssmedia.com/order.shtml?ref=AudioRetoucheropenSV	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/0Qy	0%	Avira URL Cloud	safe
https://116.202.183.33/	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/cruntime140.dll~Q	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/nss3.dllCw	0%	Avira URL Cloud	safe
https://www.abyssmedia.com/audioretoucher/open	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/Authority	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/nss3.dll	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/$t	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/vcruntime140.dll?Qt	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/:081.SF	0%	Avira URL Cloud	safe
https://116.202.183.33:25565ne	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/a	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/msvcp140.dll	0%	Avira URL Cloud	safe
https://www.abyssmedia.com/order.shtml?ref=audioretoucheropen	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/softokn3.dllI	0%	Avira URL Cloud	safe
https://www.abyssmedia.com/audioretoucher/audioretoucher.xml	0%	Avira URL Cloud	safe
https://www.abyssmedia.com/downloads/audioretoucher.exe	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/g	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/FHJKFCGIEBGIIJDdQ	0%	Avira URL Cloud	safe
http://www.openswatchbook.org/uri/2009/osb	0%	Avira URL Cloud	safe
https://www.abyssmedia.com/pad/getpad.php?pad=	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/mozglue.dll	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/?Qt	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/vcruntime140.dlll0Qy	0%	Avira URL Cloud	safe
https://116.202.183.33:25565	0%	Avira URL Cloud	safe
https://116.202.183.33:25565ontent-Disposition:	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/M	0%	Avira URL Cloud	safe
https://116.202.183.33:25565/E	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
t.me	149.154.167.99	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://t.me/redcarsc	false		high
https://steamcommunity.com/profiles/76561199577999137	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://116.202.183.33:25565/sqlite3.dll	all the necessary information.scr, 00000000.00000002.1669874156.0000000028710000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	IDBAKKEC.0.dr	false		high
https://t.me/	all the necessary information.scr, 00000000.00000002.1669874156.0000000028710000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	IDBAKKEC.0.dr	false		high
https://web.telegram.org	all the necessary information.scr, 00000000.00000003.1430749832.0000000028766000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1669874156.0000000028710000.00000004.00000020.00020000.00000000.sdmp	false		high
https://116.202.183.33:25565/freebl3.dll	all the necessary information.scr, 00000000.00000002.1674384182.000000002B7A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsps.ssl.com0?	all the necessary information.scr	false	URL Reputation: safe	unknown
http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0	all the necessary information.scr	false		high
https://116.202.183.33:25565/	all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q	all the necessary information.scr	false		high
http://ocsps.ssl.com0	all the necessary information.scr	false	URL Reputation: safe	unknown
https://116.202.183.33:25565/softokn3.dll	all the necessary information.scr, 00000000.00000002.1674384182.000000002B7A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/K	all the necessary information.scr, 00000000.00000002.1669874156.0000000028710000.00000004.00000020.00020000.00000000.sdmp	false		high
https://116.202.183.33:25565/vcruntime140.dll	all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	IDBAKKEC.0.dr	false		high
https://t.me/red	all the necessary information.scr, 00000000.00000002.1671633048.000000002A4F0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0	all the necessary information.scr	false		high
http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_	all the necessary information.scr	false		high
https://116.202.183.33:25565/mozglue.dll5	all the necessary information.scr, 00000000.00000002.1674384182.000000002B7A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.202.183.33:25565/freebl3.dll%	all the necessary information.scr, 00000000.00000002.1669874156.00000000286C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.abyssmedia.com/	all the necessary information.scr	false	Avira URL Cloud: safe	unknown
https://116.202.183.33:25565/bM	all the necessary information.scr, 00000000.00000003.1481977492.0000000028769000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.202.183.33:25565/(	all the necessary information.scr, 00000000.00000003.1481977492.0000000028769000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.202.183.33:25565/%	all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.abyssmedia.com/order.shtml?ref=AudioRetoucheropenSV	all the necessary information.scr	false	Avira URL Cloud: safe	unknown
http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0	all the necessary information.scr	false		high
https://116.202.183.33:25565x(	all the necessary information.scr, 00000000.00000003.1481977492.0000000028772000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://116.202.183.33:25565/0Qy	all the necessary information.scr, 00000000.00000003.1481794496.000000002B760000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/redcarscsp77dMozilla/5.0	all the necessary information.scr, 00000000.00000002.1671689348.000000002A510000.00000004.00001000.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1672973105.000000002A951000.00000040.00001000.00020000.00000000.sdmp	false		high
https://116.202.183.33:25565/nss3.dll	all the necessary information.scr, 00000000.00000002.1674384182.000000002B768000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1669874156.0000000028781000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.202.183.33:25565/Authority	all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	IDBAKKEC.0.dr	false		high
https://www.ssl.com/repository0	all the necessary information.scr	false		high
https://116.202.183.33:25565/nss3.dllCw	all the necessary information.scr, 00000000.00000002.1674384182.000000002B768000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.abyssmedia.com/audioretoucher/open	all the necessary information.scr	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199577999137sp77d	all the necessary information.scr, 00000000.00000002.1671689348.000000002A510000.00000004.00001000.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1672973105.000000002A951000.00000040.00001000.00020000.00000000.sdmp	false		high
https://creativecommons.org/publicdomain/zero/1.0/)	all the necessary information.scr	false		high
https://116.202.183.33:25565/cruntime140.dll~Q	all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.c	all the necessary information.scr, 00000000.00000003.1430749832.0000000028766000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000003.1481977492.0000000028781000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://116.202.183.33/	all the necessary information.scr, 00000000.00000003.1481977492.0000000028772000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1669874156.0000000028772000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.202.183.33:25565/$t	all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.202.183.33:25565/vcruntime140.dll?Qt	all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.202.183.33:25565/:081.SF	all the necessary information.scr, 00000000.00000003.1481794496.000000002B760000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	all the necessary information.scr, 00000000.00000002.1675739788.000000002BD78000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, sqlite3[1].dll.0.dr	false		high
https://116.202.183.33:25565ne	all the necessary information.scr, 00000000.00000002.1672973105.000000002A9D7000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://116.202.183.33:25565/a	all the necessary information.scr, 00000000.00000002.1669874156.00000000286C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.abyssmedia.com/order.shtml?ref=audioretoucheropen	all the necessary information.scr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	IDBAKKEC.0.dr	false		high
https://www.abyssmedia.com/audioretoucher/audioretoucher.xml	all the necessary information.scr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	IDBAKKEC.0.dr	false		high
https://116.202.183.33:25565/msvcp140.dll	all the necessary information.scr, 00000000.00000002.1674384182.000000002B7A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	IDBAKKEC.0.dr	false		high
https://116.202.183.33:25565/softokn3.dllI	all the necessary information.scr, 00000000.00000002.1674384182.000000002B7A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.abyssmedia.com/downloads/audioretoucher.exe	all the necessary information.scr	false	Avira URL Cloud: safe	unknown
https://116.202.183.33:25565/g	all the necessary information.scr, 00000000.00000003.1481866655.000000002879D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.202.183.33:25565/mozglue.dll	all the necessary information.scr, 00000000.00000002.1674384182.000000002B7A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openswatchbook.org/uri/2009/osb	all the necessary information.scr	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	IDBAKKEC.0.dr	false		high
https://116.202.183.33:25565/FHJKFCGIEBGIIJDdQ	all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crls.ssl.com/ssl.com-rsa-RootCA.crl0	all the necessary information.scr	false		high
http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0	all the necessary information.scr	false		high
https://www.abyssmedia.com/pad/getpad.php?pad=	all the necessary information.scr	false	Avira URL Cloud: safe	unknown
https://116.202.183.33:25565/?Qt	all the necessary information.scr, 00000000.00000003.1481794496.000000002B760000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.202.183.33:25565	all the necessary information.scr, 00000000.00000002.1669874156.0000000028710000.00000004.00000020.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1672973105.000000002A9D7000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.202.183.33:25565/vcruntime140.dlll0Qy	all the necessary information.scr, 00000000.00000002.1674384182.000000002B73A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.202.183.33:25565/M	all the necessary information.scr, 00000000.00000002.1669874156.000000002879A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0	all the necessary information.scr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	IDBAKKEC.0.dr	false		high
https://116.202.183.33:25565/E	all the necessary information.scr, 00000000.00000002.1669874156.00000000286C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.202.183.33:25565ontent-Disposition:	all the necessary information.scr, 00000000.00000002.1672973105.000000002AA15000.00000040.00001000.00020000.00000000.sdmp, all the necessary information.scr, 00000000.00000002.1672973105.000000002A9D7000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
116.202.183.33	unknown	Germany		24940	HETZNER-ASDE	false
149.154.167.99	t.me	United Kingdom		62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1355302
Start date and time:	2023-12-07 10:48:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	all the necessary information.scr
Detection:	MAL
Classification:	mal92.troj.spyw.evad.winSCR@1/11@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 13 Number of non-executed functions: 97
Cookbook Comments:	Found application associated with file extension: .scr

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.56.6.35, 23.56.6.27, 72.21.81.240
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, time.windows.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsps.ssl.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: all the necessary information.scr

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
116.202.183.33	rFnxSwThhn.exe	Get hash	malicious	Vidar	Browse
	rFnxSwThhn.exe	Get hash	malicious	Vidar	Browse
	dasveed.bin.exe	Get hash	malicious	Vidar	Browse
	dasveed.bin.exe	Get hash	malicious	Vidar	Browse
	Additional information for Hotel_patched.scr	Get hash	malicious	Vidar	Browse
149.154.167.99	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
	vSlVoTPrmP.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
	RO67OsrIWi.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
	KeyboardRGB.exe	Get hash	malicious	Unknown	Browse	t.me/cinoshibot
	file.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	W6qKnnjMEi	Get hash	malicious	Anubis	Browse	t.me/jhzljkhbsdklzjdlkzj281679827sjah
	snfstBXgxa	Get hash	malicious	Anubis	Browse	t.me/cui8txvnmv

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	rFnxSwThhn.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	rFnxSwThhn.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	dasveed.bin.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	dasveed.bin.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Additional information for Hotel_patched.scr	Get hash	malicious	Vidar	Browse	149.154.167.99
	CijE923xjU.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Wishes for our journey December 2023.scr	Get hash	malicious	Vidar	Browse	149.154.167.99
	UYUuh7vsdN.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	149.154.167.99
	Aaca8T1ZJ5.exe	Get hash	malicious	Babuk, Djvu, RedLine, SmokeLoader, Vidar	Browse	149.154.167.99
	O7Bptb2MyD.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	149.154.167.99
	s6n00Z3C86.exe	Get hash	malicious	Babuk, Clipboard Hijacker, DCRat, Djvu, RedLine, SmokeLoader, zgRAT	Browse	149.154.167.99
	JYAtBufpV4.exe	Get hash	malicious	DCRat, Djvu, RedLine, SmokeLoader, zgRAT	Browse	149.154.167.99
	jDmQ0fSgg6.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	CSSHJQpPTD.exe	Get hash	malicious	Babuk, Djvu, RedLine, SmokeLoader, Vidar	Browse	149.154.167.99
	JgFgdY52fi.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	149.154.167.99
	A7yXv6oIkf.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	149.154.167.99
	8PCIN6uOoT.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	149.154.167.99
	6WdbGOiF8C.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	sC46xlBFod.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	149.154.167.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	T36tj08DWE.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Banco_BPM_Payment__Receipt.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	Hesap_Hareketleri_SUN_BAGLANTI__ELEMANLARI_PRES_METMAKSANVE_TICLTDSTI_20231124_84014609_PDF.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	AYF00675.lnk	Get hash	malicious	AgentTesla, MalLnk	Browse	149.154.167.220
	rFnxSwThhn.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	oNXjXql2k2.exe	Get hash	malicious	Ghost Stealer	Browse	149.154.167.220
	rFnxSwThhn.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	PAYMENT_INVOICE.BAT.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	dasveed.bin.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	dasveed.bin.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Additional information for Hotel_patched.scr	Get hash	malicious	Vidar	Browse	149.154.167.99
	t6oXov842L.exe	Get hash	malicious	Agartha Clipper	Browse	149.154.167.220
	Seed_Phrase_Bruter___checker.exe	Get hash	malicious	AgentTesla, MicroClip, Vidar	Browse	149.154.167.220
	df.exe	Get hash	malicious	Blank Grabber	Browse	149.154.167.220
	57.exe	Get hash	malicious	Blank Grabber	Browse	149.154.167.220
	1e.exe	Get hash	malicious	Blank Grabber	Browse	149.154.167.220
	africpiou.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	G7LoJUbSv4.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	LAM_CHUAN_Q710901.pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	CijE923xjU.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
HETZNER-ASDE	https://p.feedblitz.com/t3.asp?/1081591/102442729/7821567_/~feeds.feedblitz.com/~/t/0/0/sethsblog/posts/~//jorefco.com/wp-content/ghff/nhrhg/c29sdXRpb25jZW50ZXJAbmF0aW9uYWxtaS5jb20=	Get hash	malicious	HTMLPhisher	Browse	95.216.28.234
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz	Browse	95.216.227.177
	New_Order.exe	Get hash	malicious	AgentTesla	Browse	5.9.154.209
	PGHPC-10-0033-FZB-001_I.exe	Get hash	malicious	FormBook, NSISDropper	Browse	95.216.242.245
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz	Browse	95.216.227.177
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz	Browse	95.216.227.177
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz	Browse	95.216.227.177
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz	Browse	95.216.227.177
	3DmdxH8ksO.exe	Get hash	malicious	LummaC Stealer, PrivateLoader, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	144.76.136.153
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, zgRAT	Browse	95.216.227.177
	DjZ61wINTx.exe	Get hash	malicious	LummaC Stealer, PrivateLoader, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader, Xmrig	Browse	144.76.136.153
	file.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, zgRAT	Browse	95.216.227.177
	file.exe	Get hash	malicious	Glupteba, Petite Virus, SmokeLoader, Socks5Systemz	Browse	95.216.227.177
	https://www.agfax.com/2023/12/05/usda-releases-map-showing-areas-approved-for-its-broadband-connection-program/	Get hash	malicious	Unknown	Browse	136.243.216.235
	file.exe	Get hash	malicious	Glupteba, Petite Virus, SmokeLoader, Socks5Systemz	Browse	95.216.227.177
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz	Browse	95.216.227.177
	https://zytechsolutions.com/client-support/	Get hash	malicious	Unknown	Browse	136.243.216.235
	CPT3DXkMQL.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	95.216.227.177
	1Ss2i9054R.exe	Get hash	malicious	RedLine, SectopRAT, zgRAT	Browse	94.130.51.115
	rFnxSwThhn.exe	Get hash	malicious	Vidar	Browse	116.202.183.33

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	0442.pdf.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	0442.pdf.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	AW7nbF91QE.exe	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.99
	Debt-Payment_paper.js	Get hash	malicious	Unknown	Browse	149.154.167.99
	Debt-Payment_paper.js	Get hash	malicious	Unknown	Browse	149.154.167.99
	Zam#U00f3wienie.ZD33166.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.99
	nota-gerada-53629915-21195409175.html	Get hash	malicious	Unknown	Browse	149.154.167.99
	iguufjAqnn.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer	Browse	149.154.167.99
	fNEOQV1Qo2.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer	Browse	149.154.167.99
	Techspan Statement.xlsm	Get hash	malicious	Unknown	Browse	149.154.167.99
	rFnxSwThhn.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	rFnxSwThhn.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	setup.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	nota-emitida-71515474-50633616729.html	Get hash	malicious	Unknown	Browse	149.154.167.99
	Liquidacion_por_Factorizcion_de_Creditos.exe	Get hash	malicious	GuLoader	Browse	149.154.167.99
	Shipping_doc.exe	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.99
	ZmWSzgevgt.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer	Browse	149.154.167.99
	dasveed.bin.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	ZmWSzgevgt.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer	Browse	149.154.167.99
	dasveed.bin.exe	Get hash	malicious	Vidar	Browse	149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\sqlite3[1].dll	rFnxSwThhn.exe	Get hash	malicious	Vidar	Browse
	rFnxSwThhn.exe	Get hash	malicious	Vidar	Browse
	dasveed.bin.exe	Get hash	malicious	Vidar	Browse
	dasveed.bin.exe	Get hash	malicious	Vidar	Browse
	Additional information for Hotel_patched.scr	Get hash	malicious	Vidar	Browse
	Wishes for our journey December 2023.scr	Get hash	malicious	Vidar	Browse
	UYUuh7vsdN.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	Aaca8T1ZJ5.exe	Get hash	malicious	Babuk, Djvu, RedLine, SmokeLoader, Vidar	Browse
	O7Bptb2MyD.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	s6n00Z3C86.exe	Get hash	malicious	Babuk, Clipboard Hijacker, DCRat, Djvu, RedLine, SmokeLoader, zgRAT	Browse
	JYAtBufpV4.exe	Get hash	malicious	DCRat, Djvu, RedLine, SmokeLoader, zgRAT	Browse
	CSSHJQpPTD.exe	Get hash	malicious	Babuk, Djvu, RedLine, SmokeLoader, Vidar	Browse
	JgFgdY52fi.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	A7yXv6oIkf.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	8PCIN6uOoT.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	6WdbGOiF8C.exe	Get hash	malicious	Vidar	Browse
	sC46xlBFod.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Socks5Systemz, Vidar	Browse
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Socks5Systemz, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\AKFIDHDGIEGCAKFIIJKF

Download File

Process:	C:\Users\user\Desktop\all the necessary information.scr
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGHCGCAE

Download File

Process:	C:\Users\user\Desktop\all the necessary information.scr
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCAAEHJDBKJJKFHJEBKFBGDAAE

Download File

Process:	C:\Users\user\Desktop\all the necessary information.scr
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAFIJDGHCBFHJKFCGIEBGIIJD

Download File

Process:	C:\Users\user\Desktop\all the necessary information.scr
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.848598812124929
Encrypted:	false
SSDEEP:	24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
MD5:	9664DAA86F8917816B588C715D97BE07
SHA1:	FAD9771763CD861ED8F3A57004C4B371422B7761
SHA-256:	8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
SHA-512:	E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDBAKKEC

Download File

Process:	C:\Users\user\Desktop\all the necessary information.scr
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIJKJDAF

Download File

Process:	C:\Users\user\Desktop\all the necessary information.scr
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJEHCGDB

Download File

Process:	C:\Users\user\Desktop\all the necessary information.scr
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJJJJDHIDBGHIDHIDAFB

Download File

Process:	C:\Users\user\Desktop\all the necessary information.scr
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\all the necessary information.scr
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 66791 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	66791
Entropy (8bit):	7.995531727155867
Encrypted:	true
SSDEEP:	1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5:	AC05D27423A85ADC1622C714F2CB6184
SHA1:	B0FE2B1ABDDB97837EA0195BE70AB2FF14D43198
SHA-256:	C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
SHA-512:	6D0EF9050E41FBAE680E0E59DD0F90B6AC7FEA5579EF5708B69D5DA33A0ECE7E8B16574B58B17B64A34CC34A4FFC22B4A62C1ECE61F36C4A11A0665E0536B90D
Malicious:	false
Preview:	MSCF............,...................I.................gW.e .authroot.stl..u/1.5..CK..<Tk...p.k:..c.Y:.(Qc...%Y.f_...$..DHn..6i/.]....-!QQ..}f..f...}..1....9.......pN..mI.a.....!...N.....xP.f6..C.'#.c.@GN(3.<3.......9...('3...l.l....B..x..e...UWFU.TT.l.L...._.l1......w.\..Xb.v..Q......pKP.....M`.Y......Op4=.(=P.e...p.(U.....z7MF..O......V2.....#...pj...z.!...wQ...V&.Gz..Nv.4..y(J...A..':.2Q.^u.y..<.1..2..o........H.D.S.....62.\| w(...B.......h.QZ..'....l.<....6..Z...p?... .pT.......l..S..K....FT?.....p..`.&..y..."T=l.n..egf.w..X.Y...G.m....=.}cO.7.....9....o..:.Y=.-.5....ud.J&.]..Q..._<.S....{a.=.n...PT.Um).\| kpyA....h.PXY.>.......^2U...H.....V<\...k..~....H..p...8..'..?...r>.4..!u......1\.`.<.+..n..p..]...).....L.g....#.<..c]R.U."\i.Z.>...`Q..g6....0.......F.........N.s.Z..A........m.^....a_..>v.-.mk...wt.n.:...>S..;....1...j.+m.&S......$.T...i.B=h.n...c.!e.....Y.#..bw.}...d.. ..w... .&..w.9..}k...\...=....{q.Up..y;..7.-.K.'.....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\all the necessary information.scr
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.122510181921535
Encrypted:	false
SSDEEP:	6:kKC0osurN+SkQlPlEGYRMY9z+4KlDA3RUeWc3l0:VPkPlE99SNxAhUeWcC
MD5:	E2E0182FFF9EB804885D828B1C49346F
SHA1:	2DC00EA8F33EDD6C950C0936BE34E3B1C2CB6C65
SHA-256:	554D29D993DCD9CA6F56C34EF9C3E4271270C97BB3A0CFA648CFF28D9596ECEE
SHA-512:	96754A43CCABFAC7AEA3CB8A3D3D64241BF78847D554EE26FD726B7FC07A96B29ED4C27C0A4D0F2E288F7A42878FC1310B83025BBDBE87436AFEA36522A24CB3
Malicious:	false
Preview:	p...... .........N...(..(....................................................... ..........H"......(...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".3.f.e.4.e.6.1.a.4.8.2.2.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\sqlite3[1].dll

Download File

Process:	C:\Users\user\Desktop\all the necessary information.scr
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1106998
Entropy (8bit):	6.500333177860392
Encrypted:	false
SSDEEP:	12288:dxylSMUMifofI9ayCvcZMBiMjCodEMdo8R66tCWko5+jsbFcoYuprzpGSgGSrz:d4AMB3caSZMijBI1CWkoj5auF5gGSrz
MD5:	1F44D4D3087C2B202CF9C90EE9D04B0F
SHA1:	106A3EBC9E39AB6DDB3FF987EFB6527C956F192D
SHA-256:	4841020C8BD06B08FDE6E44CBE2E2AB33439E1C8368E936EC5B00DC0584F7260
SHA-512:	B614C72A3C1CE681EBFFA628E29AA50275CC80CA9267380960C5198EA4D0A3F2DF6CFB7275491D220BAD72F14FC94E6656501E9A061D102FB11E00CFDA2BEB45
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: rFnxSwThhn.exe, Detection: malicious, Browse Filename: rFnxSwThhn.exe, Detection: malicious, Browse Filename: dasveed.bin.exe, Detection: malicious, Browse Filename: dasveed.bin.exe, Detection: malicious, Browse Filename: Additional information for Hotel_patched.scr, Detection: malicious, Browse Filename: Wishes for our journey December 2023.scr, Detection: malicious, Browse Filename: UYUuh7vsdN.exe, Detection: malicious, Browse Filename: Aaca8T1ZJ5.exe, Detection: malicious, Browse Filename: O7Bptb2MyD.exe, Detection: malicious, Browse Filename: s6n00Z3C86.exe, Detection: malicious, Browse Filename: JYAtBufpV4.exe, Detection: malicious, Browse Filename: CSSHJQpPTD.exe, Detection: malicious, Browse Filename: JgFgdY52fi.exe, Detection: malicious, Browse Filename: A7yXv6oIkf.exe, Detection: malicious, Browse Filename: 8PCIN6uOoT.exe, Detection: malicious, Browse Filename: 6WdbGOiF8C.exe, Detection: malicious, Browse Filename: sC46xlBFod.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c...........!.....&...................@.....a.........................0.......:........ .....................................0.......................@...<........................... .......................................................text....%.......&..................`.P`.data...\|'...@...(...,..............@.`..rdata..pD...p...F...T..............@.`@.bss....(.............................`..edata..........,..................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc........0......................@.0..reloc...<...@...>..................@.0B/4......8...........................@.@B/19.....R............"..............@..B/31.....]'...`...(..................@..B/45......-..........................@..B/57.....\............B..............@.0B/70.....#............N..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	0.06306709718317198
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	all the necessary information.scr
File size:	672'236'584 bytes
MD5:	df5ac38d7bc0233a2775fe6a54db880a
SHA1:	b5e261d8e49ce7f6170e270de1a1f875333dfdca
SHA256:	99e11573d54e8379e7fc2d5b2233764cef0b4f6a910ddca9df64e8aa09c3822c
SHA512:	ed05aadb081f652b0baa70d7040414c83d8d76098de7f8ffdc4bf1408974210de340e57d8170898187b0cc53e5bcb0822a7544d8d3dcdc85b554e93990bc4c9a
SSDEEP:
TLSH:
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	c0829ac38383c282

Static PE Info

General

Entrypoint:	0x632c7c
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x63BD024C [Tue Jan 10 06:14:36 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	97e5e1db7798516087c846489f89ffe5

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	30/11/2023 15:12:45 29/11/2024 15:12:45
Subject Chain	OID.1.3.6.1.4.1.311.60.2.1.3=CA, OID.2.5.4.15=Private Organization, CN=Quantum Hvac System Inc., SERIALNUMBER=1148186-0, O=Quantum Hvac System Inc., L=Mississauga, S=Ontario, C=CA
Version:	3
Thumbprint MD5:	7B5EA8EFB73306D627D24B36C0CBC4D2
Thumbprint SHA-1:	19EAC81D0A494A744919E6C6A6FA13ACFF2EAA20
Thumbprint SHA-256:	C7A7E6CEC05058FFFD6CF2DE587C477F1C1CC10EEC5AB2DA0771CA026136CC42
Serial:	46797C9105E4F2C666FAD1374B65A5B4

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
push ebx
mov eax, 00625E54h
call 00007F0935163FDCh
mov ebx, dword ptr [0063E7D4h]
mov eax, dword ptr [ebx]
call 00007F09352CFF63h
mov eax, dword ptr [ebx]
mov edx, 00632CF8h
call 00007F09352CF907h
mov ecx, dword ptr [0063E338h]
mov eax, dword ptr [ebx]
mov edx, dword ptr [0062106Ch]
call 00007F093534CCFCh
mov ecx, dword ptr [0063EA8Ch]
mov eax, dword ptr [ebx]
mov edx, dword ptr [0061C7F0h]
call 00007F09352CFF49h
mov ecx, dword ptr [0063E664h]
mov eax, dword ptr [ebx]
mov edx, dword ptr [00620A8Ch]
call 00007F09352CFF36h
mov eax, dword ptr [ebx]
call 00007F09352D0093h
pop ebx
call 00007F093515FABDh
mov al, 04h
add al, byte ptr [eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x24c000	0x5f	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x245000	0x3d9a	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x284000	0x24b58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x28116400	0x2028	Earqtput
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24f000	0x343a0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x24e018	0xf	.rdata
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x24e000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x245b98	0x97c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x249000	0x2b16	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x22d0b4	0x22d200	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x22f000	0x3d18	0x3e00	False	0.33001512096774194	data	5.22295322660833	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x233000	0xbaec	0xbc00	False	0.5940616688829787	data	6.729262238376971	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x23f000	0x5c08	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x245000	0x3d9a	0x3e00	False	0.31111391129032256	COFF DSP21k relocatable object, not stripped	5.08913218885617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x249000	0x2b16	0x2c00	False	0.2736150568181818	data	4.848948061088015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x24c000	0x5f	0x200	False	0.166015625	data	1.1055216092643714	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x24d000	0x40	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x24e000	0x27	0x200	False	0.083984375	data	0.47299244622245973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x24f000	0x343a0	0x34400	False	0.548360870215311	data	6.697707018943598	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x284000	0x24b58	0x24c00	False	0.27337106717687076	data	5.6962365217304	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
Earqtput	0x2a9000	0x27e79600	0x27e79600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x284d7c	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x284eb0	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x284fe4	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x285118	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x28524c	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x285380	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x2854b4	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x2855e8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x2857b8	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x28599c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x285b6c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x285d3c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x285f0c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x2860dc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x2862ac	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x28647c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x28664c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_ICON	0x28681c	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304			0.3516393442622951
RT_STRING	0x2871a4	0x4f0	data			0.3662974683544304
RT_STRING	0x287694	0xb70	data			0.22848360655737704
RT_STRING	0x288204	0x334	data			0.3780487804878049
RT_STRING	0x288538	0x2e8	data			0.44489247311827956
RT_STRING	0x288820	0x4a0	data			0.375
RT_STRING	0x288cc0	0x3f0	data			0.37797619047619047
RT_STRING	0x2890b0	0x3e0	data			0.40725806451612906
RT_STRING	0x289490	0xa0	data			0.7
RT_STRING	0x289530	0xe0	data			0.6473214285714286
RT_STRING	0x289610	0x110	data			0.625
RT_STRING	0x289720	0x40c	data			0.39864864864864863
RT_STRING	0x289b2c	0x3f8	data			0.36515748031496065
RT_STRING	0x289f24	0x408	data			0.29941860465116277
RT_STRING	0x28a32c	0x37c	data			0.4327354260089686
RT_STRING	0x28a6a8	0x424	data			0.3613207547169811
RT_STRING	0x28aacc	0x388	data			0.3938053097345133
RT_STRING	0x28ae54	0x394	data			0.33624454148471616
RT_STRING	0x28b1e8	0x330	data			0.4007352941176471
RT_STRING	0x28b518	0xc4	data			0.6173469387755102
RT_STRING	0x28b5dc	0x9c	data			0.6346153846153846
RT_STRING	0x28b678	0x328	data			0.45173267326732675
RT_STRING	0x28b9a0	0x3a8	data			0.3173076923076923
RT_STRING	0x28bd48	0x38c	data			0.3876651982378855
RT_STRING	0x28c0d4	0x2f4	data			0.39814814814814814
RT_RCDATA	0x28c3c8	0x20	data			1.09375
RT_RCDATA	0x28c3e8	0x10	data			1.5
RT_RCDATA	0x28c3f8	0x984	data			0.5476190476190477
RT_RCDATA	0x28cd7c	0x2	data	English	United States	5.0
RT_RCDATA	0x28cd80	0x5a55	Delphi compiled form 'TAboutForm'			0.3458162162162162
RT_RCDATA	0x2927d8	0x129d3	Delphi compiled form 'TPlayerForm'			0.2448880552968797
RT_RCDATA	0x2a51ac	0x2f5	Delphi compiled form 'Tprogressform'			0.5772787318361955
RT_RCDATA	0x2a54a4	0x2b86	Delphi compiled form 'TregisterForm'			0.307305690181296
RT_GROUP_CURSOR	0x2a802c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x2a8040	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x2a8054	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x2a8068	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x2a807c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x2a8090	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x2a80a4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x2a80b8	0x14	data			1.1
RT_VERSION	0x2a80cc	0x204	data	English	United States	0.5174418604651163
RT_MANIFEST	0x2a82d0	0x887	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.33852496564360973

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	MessageBoxA, CharNextW, LoadStringW
kernel32.dll	Sleep, VirtualFree, VirtualAlloc, lstrlenW, VirtualQuery, QueryPerformanceCounter, GetTickCount, GetSystemInfo, GetVersion, CompareStringW, IsValidLocale, SetThreadLocale, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GetLocaleInfoW, WideCharToMultiByte, MultiByteToWideChar, GetACP, LoadLibraryExW, GetStartupInfoW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetCommandLineW, FreeLibrary, GetLastError, UnhandledExceptionFilter, RtlUnwind, RaiseException, ExitProcess, ExitThread, SwitchToThread, GetCurrentThreadId, CreateThread, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, FindFirstFileW, FindClose, WriteFile, GetStdHandle, CloseHandle
kernel32.dll	GetProcAddress, RaiseException, LoadLibraryA, GetLastError, TlsSetValue, TlsGetValue, LocalFree, LocalAlloc, GetModuleHandleW, FreeLibrary
user32.dll	SetClassLongW, GetClassLongW, SetWindowLongW, GetWindowLongW, CreateWindowExW, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassW, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoW, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCaret, SetWindowRgn, SetWindowsHookExW, SetWindowTextW, SetWindowPos, SetWindowPlacement, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropW, SetParent, SetMenuItemInfoW, SetMenu, SetForegroundWindow, SetFocus, SetCursorPos, SetCursor, SetClipboardData, SetCapture, SetActiveWindow, SendMessageA, SendMessageW, ScrollWindow, ScreenToClient, RemovePropW, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageW, RegisterClipboardFormatW, RegisterClassW, RedrawWindow, PostQuitMessage, PostMessageW, PeekMessageA, PeekMessageW, OpenClipboard, MsgWaitForMultipleObjectsEx, MsgWaitForMultipleObjects, MessageBoxW, MessageBeep, MapWindowPoints, MapVirtualKeyW, LoadStringW, LoadKeyboardLayoutW, LoadIconW, LoadCursorW, LoadBitmapW, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsIconic, IsDialogMessageA, IsDialogMessageW, IsChild, InvalidateRect, InsertMenuItemW, InsertMenuW, HideCaret, GetWindowThreadProcessId, GetWindowTextW, GetWindowRect, GetWindowPlacement, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropW, GetParent, GetWindow, GetMessagePos, GetMessageExtraInfo, GetMenuStringW, GetMenuState, GetMenuItemInfoW, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameW, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextW, GetIconInfo, GetForegroundWindow, GetFocus, GetDlgItem, GetDlgCtrlID, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameW, GetClassInfoExW, GetClassInfoW, GetCapture, GetActiveWindow, FrameRect, FlashWindow, FindWindowExW, FindWindowW, FillRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EndMenu, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextExW, DrawTextW, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageA, DispatchMessageW, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcW, DefMDIChildProcW, DefFrameProcW, CreatePopupMenu, CreateMenu, CreateIconIndirect, CreateIcon, CopyImage, CloseClipboard, ClientToScreen, CheckMenuItem, CharUpperBuffW, CharUpperW, CharNextW, CharLowerBuffW, CharLowerW, CallWindowProcW, CallNextHookEx, BeginPaint, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StrokePath, StrokeAndFillPath, StretchDIBits, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixelV, SetPixel, SetEnhMetaFileBits, SetDIBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RoundRect, RestoreDC, ResizePalette, Rectangle, RectVisible, RealizePalette, Polyline, Polygon, PolyBezierTo, PolyBezier, PlayEnhMetaFile, Pie, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsW, GetTextExtentPointW, GetTextExtentPoint32W, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectW, GetNearestPaletteIndex, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionW, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, FrameRgn, ExtTextOutW, ExtFloodFill, ExcludeClipRect, EnumFontFamiliesExW, EndPath, Ellipse, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectW, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileW, CloseFigure, Chord, BitBlt, BeginPath, ArcTo, Arc, AngleArc
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, WaitForMultipleObjectsEx, VirtualQueryEx, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, SwitchToThread, SuspendThread, Sleep, SizeofResource, SetThreadPriority, SetThreadLocale, SetLastError, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, RemoveDirectoryW, ReadFile, MulDiv, LockResource, LocalFree, LoadResource, LoadLibraryExW, LoadLibraryW, LeaveCriticalSection, IsValidLocale, InitializeCriticalSection, HeapFree, HeapDestroy, HeapCreate, HeapAlloc, GlobalUnlock, GlobalLock, GlobalFree, GlobalFindAtomW, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomW, GetVersionExW, GetVersion, GetTickCount, GetThreadPriority, GetThreadLocale, GetStdHandle, GetShortPathNameW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileAttributesW, GetExitCodeThread, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcessId, GetCurrentProcess, GetCPInfoExW, GetCPInfo, GetACP, FreeResource, InterlockedExchange, InterlockedCompareExchange, FreeLibrary, FormatMessageW, FindResourceW, FindFirstFileW, FindClose, EnumSystemLocalesW, EnumCalendarInfoW, EnterCriticalSection, DeleteFileW, DeleteCriticalSection, CreateThread, CreateFileW, CreateEventW, CompareStringW, CloseHandle
advapi32.dll	RegSetValueExW, RegQueryValueExW, RegOpenKeyExW, RegFlushKey, RegCreateKeyExW, RegCloseKey
kernel32.dll	GetUserDefaultUILanguage, Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
oleaut32.dll	CreateErrorInfo, GetErrorInfo, SetErrorInfo, SysFreeString
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoTaskMemAlloc, CoCreateInstance, CoUninitialize, CoInitialize, IsEqualGUID
user32.dll	EnumDisplayMonitors, GetMonitorInfoW, MonitorFromPoint, MonitorFromWindow
msvcrt.dll	memset, memcpy
shell32.dll	ShellExecuteW, Shell_NotifyIconW, DragQueryFileW, DragFinish, DragAcceptFiles
comdlg32.dll	GetOpenFileNameW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	1	0x457bf4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 7, 2023 10:50:02.610898018 CET	49702	443	192.168.2.7	149.154.167.99
Dec 7, 2023 10:50:02.610945940 CET	443	49702	149.154.167.99	192.168.2.7
Dec 7, 2023 10:50:02.611047029 CET	49702	443	192.168.2.7	149.154.167.99
Dec 7, 2023 10:50:02.625485897 CET	49702	443	192.168.2.7	149.154.167.99
Dec 7, 2023 10:50:02.625502110 CET	443	49702	149.154.167.99	192.168.2.7
Dec 7, 2023 10:50:03.111650944 CET	443	49702	149.154.167.99	192.168.2.7
Dec 7, 2023 10:50:03.111815929 CET	49702	443	192.168.2.7	149.154.167.99
Dec 7, 2023 10:50:03.211538076 CET	49702	443	192.168.2.7	149.154.167.99
Dec 7, 2023 10:50:03.211563110 CET	443	49702	149.154.167.99	192.168.2.7
Dec 7, 2023 10:50:03.212559938 CET	443	49702	149.154.167.99	192.168.2.7
Dec 7, 2023 10:50:03.212656975 CET	49702	443	192.168.2.7	149.154.167.99
Dec 7, 2023 10:50:03.217744112 CET	49702	443	192.168.2.7	149.154.167.99
Dec 7, 2023 10:50:03.260735035 CET	443	49702	149.154.167.99	192.168.2.7
Dec 7, 2023 10:50:03.590934038 CET	443	49702	149.154.167.99	192.168.2.7
Dec 7, 2023 10:50:03.590998888 CET	443	49702	149.154.167.99	192.168.2.7
Dec 7, 2023 10:50:03.591038942 CET	443	49702	149.154.167.99	192.168.2.7
Dec 7, 2023 10:50:03.591180086 CET	443	49702	149.154.167.99	192.168.2.7
Dec 7, 2023 10:50:03.591303110 CET	49702	443	192.168.2.7	149.154.167.99
Dec 7, 2023 10:50:03.591363907 CET	49702	443	192.168.2.7	149.154.167.99
Dec 7, 2023 10:50:03.604159117 CET	49702	443	192.168.2.7	149.154.167.99
Dec 7, 2023 10:50:03.604177952 CET	443	49702	149.154.167.99	192.168.2.7
Dec 7, 2023 10:50:03.610591888 CET	49703	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:03.857471943 CET	25565	49703	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:03.857641935 CET	49703	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:03.858269930 CET	49703	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:04.108004093 CET	25565	49703	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:04.125103951 CET	25565	49703	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:04.125144958 CET	25565	49703	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:04.125242949 CET	49703	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:04.125277996 CET	49703	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:04.754888058 CET	49703	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:05.001899958 CET	25565	49703	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:05.001997948 CET	49703	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:05.002535105 CET	49703	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:05.293486118 CET	25565	49703	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:05.498429060 CET	25565	49703	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:05.498574972 CET	49703	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:05.643747091 CET	49705	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:05.890696049 CET	25565	49705	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:05.890928030 CET	49705	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:05.891315937 CET	49705	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:06.138313055 CET	25565	49705	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:06.138387918 CET	25565	49705	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:06.138469934 CET	49705	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:06.494098902 CET	49705	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:06.495942116 CET	49705	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:06.742741108 CET	25565	49705	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:07.059798956 CET	25565	49705	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:07.059911966 CET	49705	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:07.061022043 CET	49703	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:07.061563015 CET	49706	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:07.308571100 CET	25565	49703	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:07.308638096 CET	25565	49706	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:07.308707952 CET	49703	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:07.308758020 CET	49706	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:07.356628895 CET	49706	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:07.603712082 CET	25565	49706	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:07.603873014 CET	25565	49706	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:07.603944063 CET	49706	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:07.604263067 CET	49706	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:07.606523037 CET	49706	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:07.852791071 CET	25565	49706	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:08.168783903 CET	25565	49706	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:08.168809891 CET	25565	49706	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:08.168987036 CET	49706	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:08.170269012 CET	49705	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:08.170810938 CET	49709	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:08.417134047 CET	25565	49705	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:08.417180061 CET	25565	49709	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:08.417202950 CET	49705	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:08.417248964 CET	49709	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:08.417598009 CET	49709	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:08.663839102 CET	25565	49709	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:08.664088011 CET	25565	49709	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:08.664187908 CET	49709	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:08.664901972 CET	49709	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:08.726891994 CET	49709	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:08.952939987 CET	25565	49709	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:08.973361969 CET	25565	49709	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:09.305834055 CET	25565	49709	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:09.305896997 CET	25565	49709	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:09.305932045 CET	49709	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:09.305939913 CET	25565	49709	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:09.305984974 CET	25565	49709	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:09.306094885 CET	49709	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:09.306094885 CET	49709	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:09.306094885 CET	49709	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:09.365923882 CET	49706	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:09.366439104 CET	49713	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:09.612514019 CET	25565	49706	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:09.612586021 CET	49706	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:09.612709999 CET	25565	49713	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:09.612799883 CET	49713	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:09.613286972 CET	49713	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:09.859591961 CET	25565	49713	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:09.859790087 CET	25565	49713	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:09.859996080 CET	49713	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:09.860316038 CET	49713	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:09.868741035 CET	49713	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:09.868805885 CET	49713	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:10.115119934 CET	25565	49713	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:10.115161896 CET	25565	49713	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:10.115309000 CET	25565	49713	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:10.527733088 CET	25565	49713	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:10.527802944 CET	49713	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:10.651130915 CET	49709	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:10.652529001 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:10.897814989 CET	25565	49709	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:10.897886038 CET	49709	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:10.898884058 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:10.898983002 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:10.899452925 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.145888090 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.146444082 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.146569014 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.147044897 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.149393082 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.398957014 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.399570942 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.399614096 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.399643898 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.399674892 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.399712086 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.399761915 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.399791956 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.399835110 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.399857044 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.399895906 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.399912119 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.399950027 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.399971008 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.400000095 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.400026083 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.400062084 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.400084972 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.400115013 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.400140047 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.400192022 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.646950960 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.646970034 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.647061110 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.647078991 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.647128105 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.647339106 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.647388935 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.647442102 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.647484064 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.647496939 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.647536039 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.647960901 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.648034096 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.648057938 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.648096085 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.648127079 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.648170948 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.648180962 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.648224115 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.648246050 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.648293972 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.648494959 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.648539066 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.648546934 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.648595095 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.648608923 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.648654938 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.648729086 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.648777008 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.648788929 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.648838997 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.648931026 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.648977995 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.649000883 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.649049044 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.649096012 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.649138927 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.649163008 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.649204969 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.894077063 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.894104004 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.894140005 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.894161940 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.894179106 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.894196033 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.894215107 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.894262075 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.894289017 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.894449949 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.894504070 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.894514084 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.894525051 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.894536018 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.894552946 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.894570112 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.894599915 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.894618034 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.894642115 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.894660950 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.894670963 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.894684076 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.894707918 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.894726038 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.894745111 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.894787073 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.894798994 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.894840002 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.894970894 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.895015955 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.895569086 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.895620108 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.895800114 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.895843983 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.895850897 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.895889044 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.895900011 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.895941019 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.895970106 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896013021 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896022081 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.896054029 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.896064043 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896106958 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.896179914 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896230936 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.896246910 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896259069 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896290064 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.896306038 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896353006 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.896363974 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896424055 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.896493912 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896543026 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.896553993 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896569967 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896580935 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896603107 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.896610975 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.896625996 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.896665096 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896711111 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896776915 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.896789074 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896826982 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.896835089 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896873951 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.896941900 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.896986008 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.897001028 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.897021055 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:11.897053957 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:11.897068977 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.143738031 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.144009113 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.144232035 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.144288063 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.144315958 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.144335032 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.144383907 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.144404888 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.144412994 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.144450903 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.144471884 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.144522905 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.144543886 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.144589901 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.144629955 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.144675970 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.144696951 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.144741058 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.144788027 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.144830942 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.145059109 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.145103931 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.145124912 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.145174980 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.145186901 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.145226002 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.145272970 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.145313978 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.145380020 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.145411015 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.145417929 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.145447969 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.145459890 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.145500898 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.145510912 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.145556927 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.145662069 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.145710945 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.145723104 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.145765066 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.145776987 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.145812988 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.145831108 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.145869970 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.145941973 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.145986080 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.148386955 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.148428917 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.148436069 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.148472071 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.148483992 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.148529053 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.148540974 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.148586035 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.148607969 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.148652077 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.148726940 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.148767948 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.148792982 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.148816109 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.148838997 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.148849964 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.148946047 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.148993969 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.149585009 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.149632931 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.149645090 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.149682999 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.149701118 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.149740934 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.149753094 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.149796009 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.149820089 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.149832010 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.149868965 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.149889946 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.149940968 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.149962902 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.150003910 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.150010109 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.150052071 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.150058031 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.150094986 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.150175095 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.150221109 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.150243044 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.150290966 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.150312901 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.150353909 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.150365114 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.150403976 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.150417089 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.150455952 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.150506973 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.150547981 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.150561094 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.150604010 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.150615931 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.150660038 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.150671959 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.150718927 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.150824070 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.150871992 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.150883913 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.150927067 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.150939941 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.150986910 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.151851892 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.151899099 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.151999950 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.152060986 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.152069092 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.152081966 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.152107954 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.152126074 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.152146101 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.152198076 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.152266979 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.152308941 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.152431011 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.152471066 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.152483940 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.152522087 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.152534008 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.152573109 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.152594090 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.152632952 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.152645111 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.152684927 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.152695894 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.152734995 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.152745962 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.152786970 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.152822971 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.152848005 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.152858973 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.152883053 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.152894020 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.152932882 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.152944088 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.152981997 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.152993917 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.153033018 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.153045893 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.153080940 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.153101921 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.153150082 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.153165102 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.153184891 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.153204918 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.153214931 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.153250933 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.153285980 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.153332949 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.153371096 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.153393030 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.153435946 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.153448105 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.153489113 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.390589952 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.390610933 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.390681028 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.390759945 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.390789032 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.390805960 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.390819073 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.390851021 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.390871048 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.390892029 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.390933990 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.390960932 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.391002893 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.391077995 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.391115904 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.391123056 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.391164064 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.391185045 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.391226053 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.391316891 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.391360998 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.391417027 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.391459942 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.391505957 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.391540051 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.391604900 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.391644001 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.391680956 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.391720057 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.391797066 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.391843081 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.391864061 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.391906023 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.391954899 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.391993999 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.392060041 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.392098904 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.392167091 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.392206907 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.392250061 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.392290115 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.392335892 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.392364979 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.392371893 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.392400980 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.392461061 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.392507076 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.392549038 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.392595053 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.392635107 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.392682076 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.392733097 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.392781973 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.392805099 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.392849922 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.392870903 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.392915964 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.392981052 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.393023968 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.393091917 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.393132925 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.393172979 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.393213987 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.393305063 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.393346071 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.393409967 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.393450022 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.396250963 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.396303892 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.396317005 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.396368980 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.396379948 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.396420956 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.396428108 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.396469116 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.396483898 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.396522045 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.396534920 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.396574974 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.396595001 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.396634102 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.396646023 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.396668911 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.396678925 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.396713018 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.396717072 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.396755934 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.396795988 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.396864891 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.396986961 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397002935 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397013903 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397028923 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397036076 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397044897 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397054911 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397068977 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397099972 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397108078 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397135019 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397155046 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397171974 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397233963 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397283077 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397296906 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397336006 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397350073 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397397995 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397411108 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397452116 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397475004 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397511959 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397526026 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397567034 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397578955 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397618055 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397631884 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397671938 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397684097 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397722960 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397736073 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397768974 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397778988 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397810936 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397847891 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397862911 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397910118 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397922039 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.397985935 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.397996902 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398037910 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.398051977 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398092031 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.398102999 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398144007 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.398155928 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398205042 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.398216963 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398257971 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.398277044 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398288965 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398315907 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.398366928 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398411989 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.398423910 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398468018 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.398479939 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398521900 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.398542881 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398581982 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.398592949 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398634911 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.398647070 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398685932 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.398706913 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398744106 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.398756027 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398797035 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.398809910 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398854971 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.398865938 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.398905993 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.398993015 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399005890 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399060011 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399072886 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399094105 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399108887 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399137020 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399213076 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399224043 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399254084 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399266005 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399274111 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399312973 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399324894 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399337053 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399369001 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399400949 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399445057 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399483919 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399524927 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399537086 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399571896 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399585009 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399636984 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399650097 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399672985 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399682999 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399712086 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399734020 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399775982 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399799109 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399838924 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399851084 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399873018 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399885893 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399914026 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399935961 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.399977922 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.399991989 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400032043 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400043964 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400084019 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400100946 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400142908 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400156021 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400170088 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400194883 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400204897 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400232077 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400275946 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400288105 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400330067 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400342941 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400382042 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400394917 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400454044 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400466919 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400501966 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400506973 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400536060 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400544882 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400576115 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400599003 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400635004 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400664091 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400670052 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400692940 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400733948 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400748968 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400790930 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400801897 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400859118 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400868893 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400907040 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.400959015 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.400998116 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401010036 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401024103 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401052952 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401068926 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401119947 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401156902 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401161909 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401204109 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401216030 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401241064 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401249886 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401284933 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401309013 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401345015 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401352882 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401397943 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401411057 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401453018 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401465893 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401508093 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401520014 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401556015 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401566029 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401607990 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401626110 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401648045 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401662111 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401683092 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401695967 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401740074 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401763916 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401804924 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401818037 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401859045 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401874065 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401920080 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401932001 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401954889 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.401973009 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.401989937 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.402012110 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.402055025 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.402077913 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.402108908 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.402117968 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.402153969 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.402165890 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.402206898 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.402339935 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.402384996 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.402398109 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.402439117 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.402451992 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.402491093 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.402506113 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.402548075 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.402560949 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.402600050 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.402615070 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.402657032 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.402669907 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.402714968 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.402729034 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.402781963 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.402823925 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.402873039 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.402887106 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.402930021 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.402944088 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.402980089 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.402992010 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.403036118 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.403048992 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.403085947 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.403106928 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.403126001 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.637496948 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637535095 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637547016 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637558937 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637571096 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637583017 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637588978 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637619019 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.637634039 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637648106 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.637670040 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.637692928 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637706041 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637717009 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637727976 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637737989 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.637757063 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637768030 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.637768030 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.637777090 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637789965 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637831926 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637871981 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.637871981 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.637871981 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.637908936 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637938976 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637944937 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.637944937 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.637959003 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.637973070 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.637984991 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638000011 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638011932 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638032913 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638046026 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638056040 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638067007 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638091087 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638108015 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638108015 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638120890 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638139009 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638148069 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638175011 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638189077 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638192892 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638205051 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638216019 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638230085 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638242006 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638262033 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638273001 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638287067 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638298035 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638319016 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638331890 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638339996 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638350964 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638374090 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638394117 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638394117 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638413906 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638422012 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638433933 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638446093 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638463974 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638479948 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638495922 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638514042 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638533115 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638541937 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638571978 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638582945 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638595104 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638626099 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638645887 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638674974 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638685942 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638711929 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638765097 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638797045 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638817072 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638837099 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638871908 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638884068 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.638916016 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.638958931 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639003038 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.639015913 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639027119 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639048100 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639065981 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.639089108 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.639092922 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639106035 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639144897 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.639210939 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639246941 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639254093 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.639264107 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639277935 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639286041 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.639302015 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.639314890 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.639333963 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639378071 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.639393091 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639405012 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639426947 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639434099 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.639447927 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.639471054 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.639527082 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639544964 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639581919 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.639625072 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639636993 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639647007 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639653921 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.639666080 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.639683008 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.639689922 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.639725924 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.642620087 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.642632008 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.642673969 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.642713070 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.642725945 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.642761946 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.642811060 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.642858028 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.642868042 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.642879963 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.642920971 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.642931938 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.642954111 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.642971039 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.642988920 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643002033 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643027067 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643033981 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643049002 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643059015 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643066883 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643099070 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643105984 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643126965 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643138885 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643158913 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643167019 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643202066 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643214941 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643227100 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643239975 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643248081 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643265009 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643282890 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643309116 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643345118 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643351078 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643384933 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643452883 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643476009 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643492937 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643510103 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643619061 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643631935 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643660069 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643681049 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643688917 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643702984 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643723965 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643740892 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643850088 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643862963 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643889904 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643901110 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.643971920 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.643985033 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.644015074 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.644032001 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.644218922 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.644232035 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.644259930 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.644270897 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.644427061 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.644439936 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.644475937 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.644496918 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.644560099 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.644589901 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.644598961 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.644630909 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.644687891 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.644701958 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.644731998 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.644754887 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.644768953 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.644804955 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.644840956 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.644840956 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.644865036 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.644905090 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.644913912 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.644957066 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.645024061 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.645064116 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.645070076 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.645107031 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.645226955 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.645272017 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.645283937 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.645307064 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.645325899 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.645338058 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.645344973 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.645385981 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.645399094 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.645442963 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.645456076 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.645489931 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.645611048 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.645637035 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.645647049 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.645675898 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.645719051 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.645754099 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.645764112 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.645802975 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.645880938 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.645920038 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.645935059 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.645979881 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.646079063 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.646090984 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.646111965 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.646126986 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.646142006 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.646147013 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.646156073 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.646181107 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.646272898 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.646285057 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.646320105 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.646385908 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.646425962 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.646435022 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.646477938 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.646522045 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.646534920 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.646574020 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.646574020 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.646594048 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.646606922 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.646632910 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.646655083 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.646787882 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.646805048 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.646831036 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.646840096 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.646859884 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.646873951 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.646909952 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.646929026 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.647059917 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.647073030 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.647102118 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.647113085 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.647213936 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.647258997 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.647272110 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.647317886 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.647545099 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.647591114 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.647605896 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.647646904 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.647660971 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.647711039 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.647723913 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.647737026 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.647761106 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.647778034 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.647836924 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.647850990 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.647862911 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.647886992 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.647908926 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.647908926 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.647933006 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.647974014 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.647996902 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.648040056 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.648062944 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.648077011 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.648103952 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.648113966 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.648226976 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.648238897 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.648272991 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.648405075 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.648447990 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.648515940 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.648528099 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.648555040 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.648561954 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.648582935 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.648641109 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.648684978 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.648696899 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.648736000 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.648824930 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.648838043 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.648870945 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.648881912 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.648952007 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.648994923 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.649000883 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.649045944 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.649252892 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.649297953 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.649310112 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.649352074 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.649363995 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.649396896 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.649405003 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.649431944 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.649554014 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.649597883 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.649610996 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.649632931 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.649657965 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.649665117 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.649676085 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.649709940 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.649816990 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.649852037 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.649859905 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.649895906 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.649914026 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.649926901 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.649955034 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.649965048 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.650080919 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.650093079 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.650126934 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.650171995 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.650185108 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.650214911 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.650233984 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.650316954 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.650329113 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.650358915 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.650367975 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.650386095 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.650429964 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.650443077 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.650480986 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.650504112 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.650544882 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.650557041 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.650594950 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.650623083 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.650669098 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.650682926 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.650724888 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.650794029 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.650821924 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.650832891 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.650863886 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.650960922 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.651002884 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.651010990 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.651048899 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.651129961 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.651143074 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.651173115 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.651184082 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.651247025 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.651292086 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.651307106 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.651351929 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.651365042 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.651388884 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.651407957 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.651424885 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.651429892 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.651442051 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.651463032 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.651475906 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.884237051 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.884279966 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.884319067 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.884357929 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.884397030 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.884423018 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.884445906 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.884475946 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.884500027 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.884536982 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.884560108 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.884586096 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.884615898 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.884653091 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.884673119 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.884708881 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.884746075 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.884768009 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.884800911 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.884839058 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.884860039 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.884893894 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.884916067 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.884954929 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.884974003 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885010004 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885042906 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.885078907 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.885097980 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885123014 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885152102 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.885189056 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.885210991 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885245085 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885266066 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.885303974 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.885327101 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885364056 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885380030 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.885457039 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.885477066 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885505915 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885530949 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.885584116 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885618925 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.885656118 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.885678053 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885701895 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885762930 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.885802031 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.885822058 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885850906 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885876894 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.885914087 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.885934114 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885971069 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.885987043 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.886023998 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.886044025 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.886082888 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.886099100 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.886136055 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.886158943 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.886192083 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.886214018 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.886250973 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.886271000 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.886307001 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.886358023 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.886394978 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.886415005 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.886446953 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.886470079 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.886507988 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.886528015 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.886562109 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.886707067 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.886744022 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.886764050 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.886796951 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.886818886 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.886856079 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.886876106 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.886909962 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.886930943 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.886967897 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.886989117 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887022972 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887042999 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887079000 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887099981 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887131929 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887156010 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887192011 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887212038 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887238979 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887268066 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887305021 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887325048 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887352943 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887379885 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887414932 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887438059 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887469053 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887491941 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887527943 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887547016 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887564898 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887599945 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887635946 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887656927 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887691975 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887710094 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887747049 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887767076 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887801886 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887823105 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887866020 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887888908 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887931108 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.887945890 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887981892 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.887998104 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.888035059 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.888055086 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.888082981 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.888108015 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.888144016 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.888164997 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.888197899 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.888217926 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.888254881 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.888276100 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.888309002 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.888879061 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.888917923 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.888937950 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.888967991 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.888994932 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.889034033 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.889066935 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.889086962 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.889111042 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.889148951 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.889168024 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.889194965 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.889283895 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.889322996 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.889343023 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.889372110 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.889400005 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.889437914 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.889458895 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.889496088 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.889513016 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.889550924 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.889573097 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.889611006 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.889692068 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.889729023 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.889750004 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.889786005 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.889803886 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.889857054 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.890012980 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.890049934 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.890070915 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.890103102 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.890127897 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.890183926 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.890219927 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.890255928 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.890275955 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.890309095 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.890328884 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.890461922 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.890482903 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.890515089 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.890537977 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.890574932 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.890594959 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.890616894 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.890649080 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.890686989 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.890707016 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.890741110 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.890758991 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.890799999 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.890820026 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.890857935 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.890872002 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.890889883 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.890917063 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.890928984 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.891150951 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.891180038 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.891197920 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.891216040 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.891222954 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.891241074 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.891259909 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.891280890 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.891371965 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.891416073 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.891423941 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.891436100 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.891463995 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.891484022 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.891558886 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.891587973 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.891597986 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.891628981 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.891638994 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.891690016 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.891871929 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.891921043 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.891932964 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.891944885 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.891973972 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.891992092 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.892041922 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.892087936 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.892101049 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.892115116 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.892148018 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.892184973 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.892215967 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.892225027 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.892246008 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.892258883 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.892282009 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.892394066 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.892405987 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.892420053 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.892441988 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.892458916 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.892637014 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.892649889 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.892683983 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.892695904 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.892703056 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.892744064 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.892812967 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.892832041 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.892846107 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.892868996 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.892878056 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893034935 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893068075 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893076897 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893134117 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893141031 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893151999 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893163919 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893176079 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893184900 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893202066 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893237114 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893260002 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893306971 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893311977 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893336058 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893358946 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893376112 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893404007 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893435955 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893460035 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893471956 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893480062 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893512964 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893621922 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893635035 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893646955 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893671036 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893681049 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893735886 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893780947 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893793106 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893805981 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893846989 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893853903 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893918991 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.893985987 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.893997908 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.894021988 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.894047022 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.894064903 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.894119978 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.894165993 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.894179106 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.894191980 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.894218922 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.894232035 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895034075 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895047903 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895085096 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895102978 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895113945 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895127058 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895159960 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895170927 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895178080 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895214081 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895311117 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895351887 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895374060 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895406008 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895412922 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895437956 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895442963 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895476103 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895484924 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895498991 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895510912 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895519972 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895538092 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895555973 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895562887 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895601988 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895606995 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895643950 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895689964 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895701885 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895714045 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.895726919 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895744085 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.895761013 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.896012068 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.896049976 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.896110058 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.896152973 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.896279097 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.896318913 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.896382093 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.896421909 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.896460056 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.896503925 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.896517038 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.896555901 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.896657944 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.896698952 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897093058 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897140026 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897165060 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897202015 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897214890 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897257090 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897269964 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897283077 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897310019 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897327900 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897334099 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897346020 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897358894 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897367001 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897377968 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897386074 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897396088 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897403955 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897420883 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897433043 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897442102 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897466898 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897502899 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897516012 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897528887 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897536993 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897545099 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897566080 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897576094 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897608042 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897629023 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897641897 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897654057 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897665024 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897681952 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897694111 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897701979 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897716045 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897723913 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897751093 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897762060 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897769928 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897779942 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897802114 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897819042 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897826910 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897838116 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897862911 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897872925 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897881031 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897891045 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897912979 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897938967 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.897973061 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897985935 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.897999048 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898010015 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898017883 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898025990 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898046970 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898053885 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898063898 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898072958 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898085117 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898094893 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898104906 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898114920 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898128033 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898132086 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898149967 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898161888 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898169994 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898205042 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898211956 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898224115 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898237944 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898247004 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898257971 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898272991 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898282051 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898289919 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898299932 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898309946 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898324966 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898336887 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898344994 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898355007 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898380995 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898392916 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898403883 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898411989 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898427010 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898433924 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898444891 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898452044 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898462057 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898471117 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898495913 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898507118 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898523092 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898536921 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898567915 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898586988 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898607016 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898619890 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898632050 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898644924 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898652077 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898667097 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898670912 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898684025 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898691893 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898703098 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898714066 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898722887 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898736954 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898745060 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898756027 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898772955 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898798943 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898811102 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898823977 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898849010 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898860931 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898871899 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898900986 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898943901 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898957014 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.898996115 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.898996115 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899005890 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899018049 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899029970 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899041891 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899058104 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899068117 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899100065 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899106026 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899117947 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899136066 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899151087 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899162054 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899194002 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899200916 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899210930 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899229050 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899243116 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899254084 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899267912 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899292946 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899296999 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899316072 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899331093 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899342060 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899355888 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899380922 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899405003 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899418116 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899430037 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899435997 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899481058 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899497032 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899503946 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899523020 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899554014 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899687052 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899699926 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899777889 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899791956 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899813890 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899838924 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899852037 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899863958 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899897099 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899936914 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899949074 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.899956942 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.899969101 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900002003 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900010109 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900084019 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900094032 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900101900 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900116920 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900125027 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900135994 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900147915 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900162935 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900172949 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900180101 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900191069 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900202036 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900211096 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900224924 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900233984 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900252104 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900263071 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900270939 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900293112 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900300980 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900311947 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900329113 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900372982 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900396109 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900432110 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900458097 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900464058 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900464058 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900481939 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900492907 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900533915 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900540113 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900559902 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900589943 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900599003 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900624990 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900666952 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900676966 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900690079 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900722980 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900733948 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900743008 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900785923 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900799036 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900811911 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900847912 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900860071 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900866985 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900907040 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900913000 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900926113 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.900958061 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900964975 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.900975943 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901022911 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901031017 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901043892 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901077032 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901088953 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901097059 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901108027 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901119947 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901134968 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901140928 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901160002 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901170969 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901181936 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901201963 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901211023 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901232004 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901241064 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901249886 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901262045 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901269913 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901283979 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901310921 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901325941 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901340961 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901352882 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901366949 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901372910 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901381969 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901392937 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901400089 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901410103 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901417971 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901433945 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901449919 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901460886 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901473045 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901494980 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901501894 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901510954 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901529074 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901561975 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901592016 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901604891 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901618958 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901633024 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901648045 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901662111 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901671886 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901686907 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901693106 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901705980 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901712894 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901737928 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901774883 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901787996 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901801109 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901813030 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901822090 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901834011 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901843071 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901854038 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901870966 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901890993 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901899099 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901952028 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901957035 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.901981115 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.901992083 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.902017117 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.902028084 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902040958 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902053118 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902076006 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.902087927 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902096033 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.902106047 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902117968 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.902142048 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.902153015 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902164936 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902179003 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902193069 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.902204037 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902220964 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.902245045 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.902297020 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902359009 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.902369976 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902393103 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902420998 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.902437925 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.902458906 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902503967 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.902566910 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902580023 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902591944 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902604103 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:12.902614117 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.902642012 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.903264046 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.976377010 CET	49713	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:12.977108955 CET	49715	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:13.223256111 CET	25565	49713	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:13.223339081 CET	49713	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:13.223527908 CET	25565	49715	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:13.223622084 CET	49715	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:13.224080086 CET	49715	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:13.470474958 CET	25565	49715	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:13.470590115 CET	25565	49715	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:13.470679045 CET	49715	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:13.471216917 CET	49715	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:13.474924088 CET	49715	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:13.474957943 CET	49715	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:13.723752975 CET	25565	49715	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:14.074032068 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:14.074779034 CET	49716	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:14.176426888 CET	25565	49715	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:14.176584005 CET	49715	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:14.320584059 CET	25565	49714	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:14.320703983 CET	49714	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:14.321096897 CET	25565	49716	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:14.321208000 CET	49716	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:14.321657896 CET	49716	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:14.568576097 CET	25565	49716	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:14.568619013 CET	25565	49716	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:14.568766117 CET	49716	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:14.569174051 CET	49716	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:14.571266890 CET	49716	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:14.817809105 CET	25565	49716	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:15.271469116 CET	25565	49716	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:15.271545887 CET	49716	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:15.314095974 CET	49715	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:15.314965010 CET	49717	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:15.561156988 CET	25565	49715	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:15.561355114 CET	49715	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:15.561460972 CET	25565	49717	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:15.561558008 CET	49717	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:15.562094927 CET	49717	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:15.809297085 CET	25565	49717	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:15.810740948 CET	25565	49717	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:15.810830116 CET	49717	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:15.811327934 CET	49717	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:15.813776016 CET	49717	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:16.060349941 CET	25565	49717	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:16.511542082 CET	25565	49717	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:16.511642933 CET	49717	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:16.514205933 CET	49716	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:16.514950991 CET	49718	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:16.769278049 CET	25565	49716	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:16.769340038 CET	25565	49718	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:16.769387960 CET	49716	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:16.769469976 CET	49718	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:16.770405054 CET	49718	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:17.017265081 CET	25565	49718	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:17.017947912 CET	25565	49718	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:17.018038988 CET	49718	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:17.018384933 CET	49718	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:17.020315886 CET	49718	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:17.022387028 CET	49719	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:17.267431021 CET	25565	49718	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:17.267596960 CET	49718	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:17.268703938 CET	25565	49719	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:17.268795013 CET	49719	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:17.269293070 CET	49719	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:17.515577078 CET	25565	49719	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:17.516139984 CET	25565	49719	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:17.516257048 CET	49719	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:17.516854048 CET	49719	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:17.518769026 CET	49719	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:17.520792961 CET	49720	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:17.765213013 CET	25565	49719	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:17.765294075 CET	49719	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:17.767087936 CET	25565	49720	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:17.767169952 CET	49720	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:17.767522097 CET	49720	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:18.013683081 CET	25565	49720	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:18.013773918 CET	25565	49720	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:18.014017105 CET	49720	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:18.014517069 CET	49720	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:18.016439915 CET	49720	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:18.019198895 CET	49721	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:18.263066053 CET	25565	49720	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:18.263190985 CET	49720	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:18.265526056 CET	25565	49721	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:18.265785933 CET	49721	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:18.266000032 CET	49721	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:18.512342930 CET	25565	49721	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:18.513058901 CET	25565	49721	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:18.513135910 CET	49721	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:18.513454914 CET	49721	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:18.515305042 CET	49721	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:18.517211914 CET	49722	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:18.762031078 CET	25565	49721	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:18.762243986 CET	49721	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:18.763650894 CET	25565	49722	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:18.763834000 CET	49722	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:18.764241934 CET	49722	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:19.010674000 CET	25565	49722	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:19.010950089 CET	25565	49722	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:19.011030912 CET	49722	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:19.011375904 CET	49722	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:19.013477087 CET	49722	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:19.015125990 CET	49723	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:19.261084080 CET	25565	49722	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:19.261187077 CET	49722	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:19.261837006 CET	25565	49723	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:19.261926889 CET	49723	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:19.262387037 CET	49723	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:19.509160042 CET	25565	49723	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:19.509367943 CET	25565	49723	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:19.509442091 CET	49723	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:19.509844065 CET	49723	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:19.511575937 CET	49723	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:19.758953094 CET	25565	49723	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:19.759255886 CET	49723	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:19.880861044 CET	49724	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:20.128125906 CET	25565	49724	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:20.128329992 CET	49724	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:20.128917933 CET	49724	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:20.377058029 CET	25565	49724	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:20.377125025 CET	25565	49724	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:20.377310038 CET	49724	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:20.377737045 CET	49724	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:20.381000042 CET	49724	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:20.627700090 CET	25565	49724	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:20.946499109 CET	25565	49724	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:20.946549892 CET	25565	49724	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:20.946611881 CET	49724	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:20.946638107 CET	49724	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:20.950314999 CET	49717	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:20.951204062 CET	49725	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:21.197212934 CET	25565	49717	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:21.197269917 CET	25565	49725	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:21.197283983 CET	49717	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:21.197359085 CET	49725	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:21.197915077 CET	49725	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:21.444291115 CET	25565	49725	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:21.444895029 CET	25565	49725	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:21.444983959 CET	49725	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:21.445406914 CET	49725	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:21.448518038 CET	49725	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:21.694880962 CET	25565	49725	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:22.033726931 CET	25565	49725	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:22.033807039 CET	49725	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:22.095921993 CET	49724	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:22.096812963 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:22.343355894 CET	25565	49724	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:22.343424082 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:22.343492031 CET	49724	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:22.343569040 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:22.343945980 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:22.590661049 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:22.591444016 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:22.591562033 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:22.598625898 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:22.600678921 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:22.600812912 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:22.847415924 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:22.847471952 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:22.847508907 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:22.847537994 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:22.847604990 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:22.847604990 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:22.848494053 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:22.848553896 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:22.848576069 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:22.848620892 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:22.888693094 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:22.888803005 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.094440937 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.094501019 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.094537020 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.094568968 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.094604969 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.094610929 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.094636917 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.094662905 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.094670057 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.094691038 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.094716072 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.094808102 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.094852924 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.094929934 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.094978094 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.095097065 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.095150948 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.095215082 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.095266104 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.095451117 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.095495939 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.135581970 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.135726929 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.341619968 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.341681957 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.341717005 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.341727018 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.341809988 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.341836929 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.341912031 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.342184067 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.342245102 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.342298985 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.342372894 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.342416048 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.342508078 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:23.342573881 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.342727900 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.343044996 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.343173027 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.343295097 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.343333006 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.343388081 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.343492985 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.343544960 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.343655109 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.343760967 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.343873978 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.343949080 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.343981981 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.382427931 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.382890940 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.382924080 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.382956982 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.383044958 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.588493109 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.588547945 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.588582993 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.588617086 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.588790894 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.589277029 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.589658976 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.589844942 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.589900970 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.589991093 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.590023041 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.590104103 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.590137005 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.590198994 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.590230942 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.590306997 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.590359926 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.590435028 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.590468884 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.590579987 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.590980053 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.591012955 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:23.591114044 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:24.303011894 CET	25565	49726	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:24.303143978 CET	49726	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:24.750014067 CET	49725	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:24.750674963 CET	49727	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:24.996658087 CET	25565	49725	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:24.996738911 CET	49725	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:24.997345924 CET	25565	49727	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:24.997433901 CET	49727	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:24.997790098 CET	49727	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:25.245019913 CET	25565	49727	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:25.246248007 CET	25565	49727	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:25.246434927 CET	49727	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:25.246603012 CET	49727	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:25.248569965 CET	49727	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:25.495373011 CET	25565	49727	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:25.849495888 CET	25565	49727	116.202.183.33	192.168.2.7
Dec 7, 2023 10:50:25.849628925 CET	49727	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:28.516807079 CET	49727	25565	192.168.2.7	116.202.183.33
Dec 7, 2023 10:50:28.517703056 CET	49726	25565	192.168.2.7	116.202.183.33

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 7, 2023 10:50:02.475577116 CET	55634	53	192.168.2.7	1.1.1.1
Dec 7, 2023 10:50:02.600763083 CET	53	55634	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 7, 2023 10:50:02.475577116 CET	192.168.2.7	1.1.1.1	0x70a1	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 7, 2023 10:50:02.600763083 CET	1.1.1.1	192.168.2.7	0x70a1	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	149.154.167.99	443	6496	C:\Users\user\Desktop\all the necessary information.scr

Timestamp	Bytes transferred	Direction	Data
2023-12-07 09:50:03 UTC	87	OUT	GET /redcarsc HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2023-12-07 09:50:03 UTC	512	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 30 37 20 44 65 63 20 32 30 32 33 20 30 39 3a 35 30 3a 30 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 32 33 35 39 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 73 74 65 6c 5f 73 73 69 64 3d 34 31 38 31 39 33 35 39 64 38 37 35 63 63 37 33 63 63 5f 31 30 34 39 33 31 34 33 33 31 34 36 35 37 36 36 31 38 34 34 3b 20 65 78 70 69 72 65 73 3d 46 72 69 2c 20 30 38 20 44 65 63 20 32 30 32 33 20 30 39 3a 35 30 3a 30 33 20 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.18.0Date: Thu, 07 Dec 2023 09:50:03 GMTContent-Type: text/html; charset=utf-8Content-Length: 12359Connection: closeSet-Cookie: stel_ssid=41819359d875cc73cc_10493143314657661844; expires=Fri, 08 Dec 2023 09:50:03
2023-12-07 09:50:03 UTC	12359	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 72 65 64 63 61 72 73 63 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @redcarsc</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.pare

Target ID:	0
Start time:	10:49:52
Start date:	07/12/2023
Path:	C:\Users\user\Desktop\all the necessary information.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\all the necessary information.scr" /S
Imagebase:	0x400000
File size:	672'236'584 bytes
MD5 hash:	DF5AC38D7BC0233A2775FE6A54DB880A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000000.1331728696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	14%
Total number of Nodes:	1244
Total number of Limit Nodes:	161

Executed Functions

Function 61E88FCA Relevance: 9.6, Strings: 7, Instructions: 866COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 61E89339
invalid rootpage, xrefs: 61E89B28
BINARY, xrefs: 61E896A2, 61E89791
bua, xrefs: 61E89A13
sqlite_master, xrefs: 61E8932D
index, xrefs: 61E890AB, 61E89217, 61E893FF
UNIQUE, xrefs: 61E899F4

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: UNIQUE$BINARY$bua$index$invalid rootpage$sqlite_master$sqlite_temp_master
API String ID: 0-1733444394
Opcode ID: 23258f6630b6473f7776cb08bfc6c784fb41f9ca11d244a27a90c0fe0e76f012
Instruction ID: c52f25025489653eb610d6e343a086c80a5a7374dd8721026aec1ef0af0b0df4
Opcode Fuzzy Hash: 23258f6630b6473f7776cb08bfc6c784fb41f9ca11d244a27a90c0fe0e76f012
Instruction Fuzzy Hash: 1892F174E08255CFDB51CFA8C580B99BBF1BF89308F65C1A9E859AB352D734E881CB41

Uniqueness

Uniqueness Score: -1.00%

Function 61EAD2AC Relevance: 6.6, Strings: 5, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

BINARY, xrefs: 61EAD40C, 61EAD478, 61EAD4A0
NOCASE, xrefs: 61EAD4C8
kqa, xrefs: 61EAD645
main, xrefs: 61EAD638
RTRIM, xrefs: 61EAD507

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: strcmp
String ID: BINARY$NOCASE$RTRIM$kqa$main
API String ID: 1004003707-114998471
Opcode ID: f6501512400433d73c0f6347e04bf113c3db028c500413ac63f89a1f0889c187
Instruction ID: 60bcc8b0197c989f7013f8b1edc5a9d28cf944306873f66ca73508c1f88d5ce1
Opcode Fuzzy Hash: f6501512400433d73c0f6347e04bf113c3db028c500413ac63f89a1f0889c187
Instruction Fuzzy Hash: DEE149B4A087858BEB00DF68C59474ABBF1BF89308F24C86DEC989F395D779C8458B51

Uniqueness

Uniqueness Score: -1.00%

Function 61E354D1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,61ECC400,?,61E35248), ref: 61E354EB

Strings

HRa, xrefs: 61E3554C

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: InfoSystem
String ID: HRa
API String ID: 31276548-1004199025
Opcode ID: 90f829b77809e80cd7cc556866e5c439b2c19dcd8d7a36888ffec522c66ecd4c
Instruction ID: 06cda1940385b8855eb11c4b22b944da250b3e82bd825487f891a332eec36e05
Opcode Fuzzy Hash: 90f829b77809e80cd7cc556866e5c439b2c19dcd8d7a36888ffec522c66ecd4c
Instruction Fuzzy Hash: 56F03AB02083419BD704AFA4C60631FBAF5AFC6B09F66C82DD1858B380CB75D8559B93

Uniqueness

Uniqueness Score: -1.00%

Function 61E75F1F Relevance: 3.3, Strings: 2, Instructions: 815COMMON

Download Yara Rule

Strings

multiple recursive references: %s, xrefs: 61E76A4B
recursive reference in a subquery: %s, xrefs: 61E76A54

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: multiple recursive references: %s$recursive reference in a subquery: %s
API String ID: 0-3854365051
Opcode ID: 0f72b0bbb797a1947647ee02b88205dbd200999246260b021fa721c86bf744e8
Instruction ID: 7d5e909c26c2478cc4d8a1152a5e5b16c7ea0641b558a5fde8b477d39de8e8ad
Opcode Fuzzy Hash: 0f72b0bbb797a1947647ee02b88205dbd200999246260b021fa721c86bf744e8
Instruction Fuzzy Hash: 4E8207B4A052899FEB25CFA8C180B9DBBF1BF48308F24C559E859AB355D734E846CF50

Uniqueness

Uniqueness Score: -1.00%

Function 61E4B8A1 Relevance: 1.6, APIs: 1, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcmp.MSVCRT ref: 61E4BBA6

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: a8ff26a4ae31eb3c0b072aa693abe32b47297d605d85dc291845808d49d3b3ac
Instruction ID: 0d30bdf3ca1535cc6e9debfec2a3fa3a34d16498aff86589297f71c0a5a37c1e
Opcode Fuzzy Hash: a8ff26a4ae31eb3c0b072aa693abe32b47297d605d85dc291845808d49d3b3ac
Instruction Fuzzy Hash: 7DC15D30E082858BEB15CFA8E4D079D7AF1AF8831CF29C46DD8469B349EB74D885CB51

Uniqueness

Uniqueness Score: -1.00%

Function 61E4C7C5 Relevance: 8.0, APIs: 4, Strings: 1, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcmp.MSVCRT ref: 61E4C91F
memcmp.MSVCRT ref: 61E4C973
memcmp.MSVCRT ref: 61E4C9F2
memcmp.MSVCRT ref: 61E4CC23

Strings

0, xrefs: 61E4CC0C

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID: 0
API String ID: 1475443563-4108050209
Opcode ID: 5e6f3149d2315a7f97a97c29b0eb816d1210dd2dcce0a1c73a13da43e11864dd
Instruction ID: 3bb57cbd4086e38ca070a1eb41e2420ec87b0c0feb17810d174f813009c16240
Opcode Fuzzy Hash: 5e6f3149d2315a7f97a97c29b0eb816d1210dd2dcce0a1c73a13da43e11864dd
Instruction Fuzzy Hash: 66127D70F05255CFEB05CFA8E484789BBF1AF48318F25C1A9D845AB356D774E88ACB80

Uniqueness

Uniqueness Score: -1.00%

Function 61E541A0 Relevance: 6.8, APIs: 2, Strings: 2, Instructions: 772stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E541DC
strcmp.MSVCRT ref: 61E543C4

Part of subcall function 61E0AE03: free.MSVCRT ref: 61E0AE3D

Strings

@, xrefs: 61E54291
rnal, xrefs: 61E547EC

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: strcmp$free
String ID: @$rnal
API String ID: 3401341699-826727331
Opcode ID: bf8b266e26bc42fdac39dc00ff5882abc0b7617591005bd688e0500b149f09b6
Instruction ID: 0ce42be2a52064457b78e7c31244c3f07411abd0ae8e299ce13c5538bbb98839
Opcode Fuzzy Hash: bf8b266e26bc42fdac39dc00ff5882abc0b7617591005bd688e0500b149f09b6
Instruction Fuzzy Hash: 70822470A04259CFEB60CF68C880B89BBF1BF45308F2481EAD8589B352E775D9A5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E4928D Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 309
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 61E4947D

Strings

winOpen, xrefs: 61E49605
exclusive, xrefs: 61E493FC

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: CreateFile
String ID: exclusive$winOpen
API String ID: 823142352-1568912604
Opcode ID: fbefb8bb2e50369de4768ffbb59d9952fc6cfb2942c402bc5831c395ef54ee7e
Instruction ID: ddd978882cd5270fa8f94071a9300b4b805ea89cb158bd2aa8a7dfbc70792811
Opcode Fuzzy Hash: fbefb8bb2e50369de4768ffbb59d9952fc6cfb2942c402bc5831c395ef54ee7e
Instruction Fuzzy Hash: B4D1A2709047499FDB10DFA9D58478EBBF0AF88318F208929E868EB394E774D985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E33F01 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 61E33FB1

Strings

winRead, xrefs: 61E33FF4

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: FileRead
String ID: winRead
API String ID: 2738559852-2759563040
Opcode ID: 851fea00ae6f1ba7616ac175e32ee1177d3feb74bace6ba213d978081e29e1e5
Instruction ID: 0463a8294cdaeeb391ba6f45b5ad466d8cdf6662135ec028d0205bc88dba3c8e
Opcode Fuzzy Hash: 851fea00ae6f1ba7616ac175e32ee1177d3feb74bace6ba213d978081e29e1e5
Instruction Fuzzy Hash: 2041E475A052699BCF04CFA8D88498EBBF2FF88314F618529E868A7354D730E941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 2A2263C5 Relevance: 3.0, APIs: 2, Instructions: 42
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(2A22A201,80000000,00000001,00000000,00000003,00000080,00000000), ref: 2A2263FD
FindCloseChangeNotification.KERNEL32(00000000), ref: 2A226429

Memory Dump Source

Source File: 00000000.00000002.1670894968.000000002A221000.00000040.00001000.00020000.00000000.sdmp, Offset: 2A221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a221000_all the necessary information.jbxd

Similarity

API ID: ChangeCloseCreateFileFindNotification
String ID:
API String ID: 727422849-0
Opcode ID: 020c76ff6c63822b97a97448b24ed4e00ed7d73fca35b022d202c0ed5cda1de0
Instruction ID: 9d71bef1373d270af357fc2e5046d5b54213565672e197ca8387602480c44b00
Opcode Fuzzy Hash: 020c76ff6c63822b97a97448b24ed4e00ed7d73fca35b022d202c0ed5cda1de0
Instruction Fuzzy Hash: 35012832281500BEFBB567A4CD46FA43381EBD0700F654121F904EB4E2C974FE049608

Uniqueness

Uniqueness Score: -1.00%

Function 61E2A652 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

realloc.MSVCRT ref: 61E2A66D

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: realloc
String ID:
API String ID: 471065373-0
Opcode ID: e26b6afafbe88dd408296985b2cf5437b863de116ceff75567ad09f3e2b45908
Instruction ID: 4040ac9b910eb7d7724dfc403353a0a40a3fe088e4c24dccbd46c39564703f2d
Opcode Fuzzy Hash: e26b6afafbe88dd408296985b2cf5437b863de116ceff75567ad09f3e2b45908
Instruction Fuzzy Hash: C3F0F97180530A9FDB109F55C58195DFBE8EF84268F14C86DE8984B310D374E544CF91

Uniqueness

Uniqueness Score: -1.00%

Function 61E0AE03 Relevance: 1.3, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 61E0AE3D

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 515cd9b0cc975ca03c008dfe43f6ff5eb83953987e78c9cd7cdb726aa12e4eb5
Instruction ID: a929929d55870eb2e3dfc3d9b08de53e37bb6c9da6c43a06ed963554b33c57a4
Opcode Fuzzy Hash: 515cd9b0cc975ca03c008dfe43f6ff5eb83953987e78c9cd7cdb726aa12e4eb5
Instruction Fuzzy Hash: A5F090B1554708CFDB006FA8E8C52153BA4F746219F5840BAE8150B201D735D5E1CB91

Uniqueness

Uniqueness Score: -1.00%

Function 61E2A6AF Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 61E2A6BF

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1f2356de957b5852e51c4f16dd739168b253dd6d2aac726755fb4680bcc79cb1
Instruction ID: 08a60fc229ca929b4850671bf03eed3452f9cad2ea52f9bb94d0a5c68b8f0e05
Opcode Fuzzy Hash: 1f2356de957b5852e51c4f16dd739168b253dd6d2aac726755fb4680bcc79cb1
Instruction Fuzzy Hash: 68F039B0C4830A9FCB009FA5DAC5A0DBBE8EB84258F14C46DE8988F710D334E580CB51

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 61E4304E Relevance: 31.5, APIs: 1, Strings: 19, Instructions: 1527COMMON

Download Yara Rule

Strings

no such column, xrefs: 61E43DC8
window, xrefs: 61E44351
excluded, xrefs: 61E438A5
H, xrefs: 61E43766
za, xrefs: 61E448C1
false, xrefs: 61E43198
ambiguous column name, xrefs: 61E43DC3
parameters, xrefs: 61E4482B
aggregate, xrefs: 61E4434A
subqueries, xrefs: 61E447D9
ROWID, xrefs: 61E43F8E
old, xrefs: 61E4386A
main, xrefs: 61E4331F
Q{a, xrefs: 61E4465A
new, xrefs: 61E43838
the "." operator, xrefs: 61E43209
M, xrefs: 61E43A55
true, xrefs: 61E43181
non-deterministic functions, xrefs: 61E44232

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: za$H$M$Q{a$ROWID$aggregate$ambiguous column name$excluded$false$main$new$no such column$non-deterministic functions$old$parameters$subqueries$the "." operator$true$window
API String ID: 0-995943838
Opcode ID: e289931867c22b3b2b5c15c539e3e1e0f969360927f4254d56908ed90e18b91f
Instruction ID: 1d323ea87534b4984c39532d96b7a68bc5a2d3eb5612128e3b04e89f7f046be3
Opcode Fuzzy Hash: e289931867c22b3b2b5c15c539e3e1e0f969360927f4254d56908ed90e18b91f
Instruction Fuzzy Hash: 9AF25A74A042658FEB20CF68D980B99BBF1BF49308F24C5DAD8999B391D770E985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 61E94783 Relevance: 22.4, Strings: 17, Instructions: 1152COMMON

Download Yara Rule

Strings

simple, xrefs: 61E94CA1
rowid, xrefs: 61E951BE
_content, xrefs: 61E958F1
8a, xrefs: 61E950D1
content, xrefs: 61E94C7D
a, xrefs: 61E9543E
uncompress, xrefs: 61E950CC
4, xrefs: 61E94E16
fts3, xrefs: 61E9578D
va, xrefs: 61E9518C
bua, xrefs: 61E95230
bua, xrefs: 61E95282
compress, xrefs: 61E950C7
@Da, xrefs: 61E94970
bua, xrefs: 61E95118
, ?, xrefs: 61E952EC
__langid, xrefs: 61E9554B

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: free
String ID: , ?$4$8a$@Da$__langid$_content$bua$bua$bua$compress$content$fts3$rowid$simple$uncompress$va$a
API String ID: 1294909896-3798220086
Opcode ID: ba4c73f9344750764dff1fade232655f42d8a9c7eefb1481278b5d197693f50e
Instruction ID: ef7f48c3fdd7dc8ca6414c769173e2ec05d9438d07e734940b1c5d50411cadd4
Opcode Fuzzy Hash: ba4c73f9344750764dff1fade232655f42d8a9c7eefb1481278b5d197693f50e
Instruction Fuzzy Hash: 40C2B0B49083598FDB10CFA8C58479DBBF1AF88318F2589AED898AB341D774D985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E89E0E Relevance: 21.9, APIs: 1, Strings: 13, Instructions: 889COMMON

Download Yara Rule

Strings

bua, xrefs: 61E8A704
, , xrefs: 61E8A717
bua, xrefs: 61E89E80
table, xrefs: 61E8A4AE
bua, xrefs: 61E89EE8
, xrefs: 61E8A722
BINARY, xrefs: 61E8AA07
VIEW, xrefs: 61E8A4A4
TABLE, xrefs: 61E8A4A9
,)?, xrefs: 61E8A70F
view, xrefs: 61E8A4B6
sqlite_sequence, xrefs: 61E8A99D
<va, xrefs: 61E8A6FF

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: $, $,)?$<va$BINARY$TABLE$VIEW$bua$bua$bua$sqlite_sequence$table$view
API String ID: 0-1924526440
Opcode ID: 477c36b52fc64823719cea4cd9a4285d391a63348142dc1e68db11b3679a7b7f
Instruction ID: 7e928e732a07f98dc879ebd84ab0464052c32152e924ddb65c1e78ed1b741658
Opcode Fuzzy Hash: 477c36b52fc64823719cea4cd9a4285d391a63348142dc1e68db11b3679a7b7f
Instruction Fuzzy Hash: 92824674A45245CFDB44CFA8C18079DBBF1BF88308F25C569E899AB3A5D774E882CB41

Uniqueness

Uniqueness Score: -1.00%

Function 61E9E24F Relevance: 17.1, Strings: 13, Instructions: 869COMMON

Download Yara Rule

Strings

rowid, xrefs: 61E9E89A, 61E9E993
k PRIMARY KEY, v, xrefs: 61E9ECC4
config, xrefs: 61E9ECC9
content, xrefs: 61E9E6BE, 61E9EC68, 61E9EE3F
segid, term, pgno, PRIMARY KEY(segid, term), xrefs: 61E9EAF2
idx, xrefs: 61E9EAF7
bua, xrefs: 61E9E43E
id INTEGER PRIMARY KEY, block BLOB, xrefs: 61E9EACC
id INTEGER PRIMARY KEY, sz BLOB, xrefs: 61E9EC9F
docsize, xrefs: 61E9ECA4, 61E9EE46
data, xrefs: 61E9EAD1
version, xrefs: 61E9ECE8
bua, xrefs: 61E9ED4E

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: bua$bua$config$content$data$docsize$id INTEGER PRIMARY KEY, block BLOB$id INTEGER PRIMARY KEY, sz BLOB$idx$k PRIMARY KEY, v$rowid$segid, term, pgno, PRIMARY KEY(segid, term)$version
API String ID: 0-2268357529
Opcode ID: 9bcf49bc565187afab332913d4634d8b2cee858e185ece13e3ebc56dd0ac48c8
Instruction ID: f9c2f8dafde392a94833a84278d27f7abaf5337b7a20f26a6dc113648fca896e
Opcode Fuzzy Hash: 9bcf49bc565187afab332913d4634d8b2cee858e185ece13e3ebc56dd0ac48c8
Instruction Fuzzy Hash: FE8206B49046499FDB10CFA9C18079DBBF1BF89318F25C92EE894AB395D774D881CB42

Uniqueness

Uniqueness Score: -1.00%

Function 61EA2F47 Relevance: 10.3, APIs: 2, Strings: 4, Instructions: 1261COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61EA3821
memcmp.MSVCRT ref: 61EA397C

Strings

UPDATE, xrefs: 61EA3C5F
docsize, xrefs: 61EA3F81
content, xrefs: 61EA356B
DELETE from, xrefs: 61EA3C5A

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID: DELETE from$UPDATE$content$docsize
API String ID: 1475443563-2142216780
Opcode ID: cfe8dd36447f5c87a997d22ee7480b159a5443c272ed03fefd8aad1bb905de17
Instruction ID: 70c6a14bc8af06d6aef6aa9ad5cb9e7fc1cc1a093b7b28355e50790c232760be
Opcode Fuzzy Hash: cfe8dd36447f5c87a997d22ee7480b159a5443c272ed03fefd8aad1bb905de17
Instruction Fuzzy Hash: ABC2F674A042598FDB10DFA8C980B8DBBF1BF88308F2585A9D849AB345D774ED85CF81

Uniqueness

Uniqueness Score: -1.00%

Function 61E56F18 Relevance: 9.6, APIs: 5, Strings: 1, Instructions: 606COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E57166

Strings

NEAR, xrefs: 61E57493

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID: NEAR
API String ID: 1475443563-1088024997
Opcode ID: 4d2cf3cb9872dd5940cabedcc3a15d50b3ea5f83f0767353deead4732f133efd
Instruction ID: b4e98ac7f2dea276e522b18a44adf406a464a3194d3be0cff96e2c83306ccf13
Opcode Fuzzy Hash: 4d2cf3cb9872dd5940cabedcc3a15d50b3ea5f83f0767353deead4732f133efd
Instruction Fuzzy Hash: 464234B4D08289CFDB80CFA8C18479DBBF1BB49308FA4C45AD8549B345D776E8A6CB51

Uniqueness

Uniqueness Score: -1.00%

Function 61E64E0C Relevance: 9.5, Strings: 5, Instructions: 3235COMMON

Download Yara Rule

Strings

N, xrefs: 61E65461
BINARY, xrefs: 61E671D6
J, xrefs: 61E6511A
`, xrefs: 61E68304
, xrefs: 61E67682

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: $ N$BINARY$J$`
API String ID: 0-2078302688
Opcode ID: 205682a561138bcb6a710c7f7428b934cef1c40cdd08bb27edb1ef22482e4d07
Instruction ID: 8b687d588507154f9b7ca5d7c21d8a58e11a900b957e56d8d79dd7eab4857ed6
Opcode Fuzzy Hash: 205682a561138bcb6a710c7f7428b934cef1c40cdd08bb27edb1ef22482e4d07
Instruction Fuzzy Hash: 3C730474A452698FEB60CF18C880B99B7F1BF49314F6585DAD848AB391D770EE81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 61E7B85E Relevance: 9.3, APIs: 1, Strings: 4, Instructions: 1812stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E7BD05

Strings

BINARY, xrefs: 61E7C2A2
q, xrefs: 61E7CF4D
p, xrefs: 61E7BF15
rows inserted, xrefs: 61E7C4C2

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: strcmp
String ID: BINARY$p$q$rows inserted
API String ID: 1004003707-1829360308
Opcode ID: edff5afc14e77e015ef3505c33aafbff6d17b2276f7888dea0f588066a8c2430
Instruction ID: 065edfd01cf961ed3b9e2e1e11ae97a3b52417d8b8be7254ab2c95bfb3f70183
Opcode Fuzzy Hash: edff5afc14e77e015ef3505c33aafbff6d17b2276f7888dea0f588066a8c2430
Instruction Fuzzy Hash: 8113D574A0425A8FEB21CF68C980B99B7F1AB89304F20C5E9D889A7351D774EEC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E62CA3 Relevance: 9.1, Strings: 6, Instructions: 1622COMMON

Download Yara Rule

Strings

u, xrefs: 61E63A4C
2, xrefs: 61E630F0
BINARY, xrefs: 61E63D74
NOCASE, xrefs: 61E63D79
false, xrefs: 61E63127
E, xrefs: 61E64125

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: 2$BINARY$E$NOCASE$false$u
API String ID: 0-3666730823
Opcode ID: efa8139e6f5d2f11e70d044c05088fc83a1464dfbf57832dfbff18415d5b4c26
Instruction ID: 6b9246b4563a5e155af7b98e7ab84f845b82c0e831d1f7dba739a0367b6c7f33
Opcode Fuzzy Hash: efa8139e6f5d2f11e70d044c05088fc83a1464dfbf57832dfbff18415d5b4c26
Instruction Fuzzy Hash: 39F24774A442598FDB10CFA8C480B8DBBF5BF49318F65C169E858AB355D734EC86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 61E19208 Relevance: 8.5, Strings: 6, Instructions: 967COMMON

Download Yara Rule

Strings

-, xrefs: 61E195B8
$, xrefs: 61E19687
, xrefs: 61E1A20D
-, xrefs: 61E1997C
NaN, xrefs: 61E19A67
Inf, xrefs: 61E1A717

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: $$$-$-$Inf$NaN
API String ID: 0-2883260867
Opcode ID: 028b7e2239e5b65ec7313dae655860b22c75c4cb4265c042bc54a10a851200c5
Instruction ID: 08ada5b9c357915bf8dc0511ebd4b169d1569d08758c0a6763b5a4183e8dfcc3
Opcode Fuzzy Hash: 028b7e2239e5b65ec7313dae655860b22c75c4cb4265c042bc54a10a851200c5
Instruction Fuzzy Hash: 8D92B370E4D2958EDB219B68C881398BBF1AB86344F34C4D9C49D9736AE735CAC9CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E9316A Relevance: 8.3, Strings: 6, Instructions: 804COMMON

Download Yara Rule

Strings

ha, xrefs: 61E932B5
bua, xrefs: 61E93379
snippet, xrefs: 61E931A7
ma, xrefs: 61E932BF
A, xrefs: 61E9338F
]a, xrefs: 61E932AB

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: A$]a$bua$ha$ma$snippet
API String ID: 0-4021802672
Opcode ID: 6a4c09e2da3f509035e1c680888309e77d346293ee25369e08d4b4030ba6012e
Instruction ID: b2623b0ed89b922f0be96898bd960c36401f43a5980a856a5f0c11e76d1438fa
Opcode Fuzzy Hash: 6a4c09e2da3f509035e1c680888309e77d346293ee25369e08d4b4030ba6012e
Instruction Fuzzy Hash: C392CF7490426ACFDB64CF69C884BC9B7B1BB48314F2486EAD85DAB250D7709EC5CF90

Uniqueness

Uniqueness Score: -1.00%

Function 61E86668 Relevance: 8.2, Strings: 6, Instructions: 719COMMON

Download Yara Rule

Strings

row , xrefs: 61E86EA4
wrong # of entries in index , xrefs: 61E86DE9
missing from index , xrefs: 61E86ED7
d, xrefs: 61E866B5
non-unique entry in index , xrefs: 61E8700A
q, xrefs: 61E86DD9

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: missing from index $d$non-unique entry in index $q$row $wrong # of entries in index
API String ID: 0-2434882124
Opcode ID: b09cbf8703d9d87b2f1a8ebc32f32eaaf7384cf710c0e597a158d0954e8262a1
Instruction ID: 64764bd2453105caa9badb98113fecf854144ac2eeaebcc13dcf1322e2d74596
Opcode Fuzzy Hash: b09cbf8703d9d87b2f1a8ebc32f32eaaf7384cf710c0e597a158d0954e8262a1
Instruction Fuzzy Hash: 5272E374A042898FDB50DFA8C59079DBBF1BB88304F20C56DE8A8AB395D775E942CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61EAF900 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 61EAF94F
UnhandledExceptionFilter.KERNEL32 ref: 61EAF95F
GetCurrentProcess.KERNEL32 ref: 61EAF968
TerminateProcess.KERNEL32 ref: 61EAF979
abort.MSVCRT ref: 61EAF982

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: a4a9847f77e74dada988f497729c1a98e5ce87648e4cbf1531909a786ce77a21
Instruction ID: c24ac7f06ebf37709200600ee493e26a75483ae19b01d267103323a56ae8c6ad
Opcode Fuzzy Hash: a4a9847f77e74dada988f497729c1a98e5ce87648e4cbf1531909a786ce77a21
Instruction Fuzzy Hash: A911C0B5A14A04CFDB00EFB9D64861EBBF0EB5A304F548929E998CB311E774D9848F52

Uniqueness

Uniqueness Score: -1.00%

Function 61EAF850 Relevance: 7.6, APIs: 5, Instructions: 54timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 61EAF889
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61EAF89A
GetCurrentThreadId.KERNEL32 ref: 61EAF8A2
GetTickCount.KERNEL32 ref: 61EAF8AA
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61EAF8B9

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 11ba3c5eec943ccd272f0a4fc468b32cfef13cd0c029082f67a55811cb38d485
Instruction ID: 8be46cd1f480235cb6d0906dde7f3b0c5fd652d59fe7cf958993e94cb5683476
Opcode Fuzzy Hash: 11ba3c5eec943ccd272f0a4fc468b32cfef13cd0c029082f67a55811cb38d485
Instruction Fuzzy Hash: 8D1170B29553118FCB00DFB9E58855BBBE0FB89654F050939E544CB200EB35D9898B92

Uniqueness

Uniqueness Score: -1.00%

Function 61EA0BA9 Relevance: 6.9, Strings: 5, Instructions: 655COMMON

Download Yara Rule

Strings

bua, xrefs: 61EA0CD2
, xrefs: 61EA131C
bua, xrefs: 61EA139A
ASC, xrefs: 61EA138A
DESC, xrefs: 61EA1392

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: $ASC$DESC$bua$bua
API String ID: 0-1029442847
Opcode ID: 11004552ce44e21a703aa9b93f3190501c3d6f2c22066ac9fe7d5c7b9da07f3f
Instruction ID: 8ab5de4e3564c360289137fee1b889a4ea914830ed3e88a553d2216b992680de
Opcode Fuzzy Hash: 11004552ce44e21a703aa9b93f3190501c3d6f2c22066ac9fe7d5c7b9da07f3f
Instruction Fuzzy Hash: 0852E2B4A053498FDB10CFA9C580A8EBBF1BF89304F25856DE899AB351D734E846CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E95D7A Relevance: 5.1, APIs: 2, Strings: 1, Instructions: 634COMMON

Download Yara Rule

Strings

bua, xrefs: 61E95E6E

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: bua
API String ID: 0-3993766197
Opcode ID: 52c6be3e544cde4861d3357b588add8e778dedffd4832021fb38687e275be97c
Instruction ID: 89212f946684aa561643b7df03f99292a836ac537f2e11e87534a7b7dd14634b
Opcode Fuzzy Hash: 52c6be3e544cde4861d3357b588add8e778dedffd4832021fb38687e275be97c
Instruction Fuzzy Hash: 80520870E05299CFDB01DFE8C484A8DBBF1BF48314F65886AE854AB355D774E886CB81

Uniqueness

Uniqueness Score: -1.00%

Function 61E69E8F Relevance: 5.1, Strings: 3, Instructions: 1365COMMON

Download Yara Rule

Strings

, xrefs: 61E6B27C
UNION, xrefs: 61E6A36F, 61E6AB2F, 61E6AD4A
bua, xrefs: 61E69F31

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: $UNION$bua
API String ID: 0-1951513331
Opcode ID: 08548ec529c2c50937b245922a76a6e3673d84f92a52e20a33822fab6eb66f8c
Instruction ID: 9efb736ff544b0c2fdcebf589f92ceeca8f8718efffafec2a72c2baed2a884dd
Opcode Fuzzy Hash: 08548ec529c2c50937b245922a76a6e3673d84f92a52e20a33822fab6eb66f8c
Instruction Fuzzy Hash: EAE2E374A442698FDB60CF68C990B9DBBF1BF88304F60C099E898AB355DB35D985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E4E4BF Relevance: 5.0, APIs: 3, Instructions: 1300COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 61E4F618
memmove.MSVCRT ref: 61E4F713
memmove.MSVCRT ref: 61E4F7B5

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 3052dd6b183d23eb00fa257d1b6072fbe3f93ea8dff08481288801a980e7090e
Instruction ID: bc40f1fef1a9170960cc57993c705059dbee377a108b532450c26420989eb83f
Opcode Fuzzy Hash: 3052dd6b183d23eb00fa257d1b6072fbe3f93ea8dff08481288801a980e7090e
Instruction Fuzzy Hash: ACE2F174A046698FCB65CF69D880BD9B7F1BF89314F2481E9D948A7314D738AE85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 61E77452 Relevance: 4.4, Strings: 2, Instructions: 1874COMMON

Download Yara Rule

Strings

ROWID, xrefs: 61E777EF
rows updated, xrefs: 61E78DEC

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: ROWID$rows updated
API String ID: 0-3149524134
Opcode ID: 10c3c291b6250a95a3628b654b38b879a742252964cfea307f88bfded4c6e01f
Instruction ID: d39c60c32cc69d7ad3465f9f6cb7242007ae0eab8187012a9ec74863cc1168bc
Opcode Fuzzy Hash: 10c3c291b6250a95a3628b654b38b879a742252964cfea307f88bfded4c6e01f
Instruction Fuzzy Hash: 5913E474A04259CFEB20CFA8C484B9DBBF1BF89308F208559D899AB355D774E986CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E6DDA5 Relevance: 4.1, Strings: 3, Instructions: 351COMMON

Download Yara Rule

Strings

$va, xrefs: 61E741D9
(, xrefs: 61E6E29B
string or blob too big, xrefs: 61E74182

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: $va$($string or blob too big
API String ID: 0-3448955768
Opcode ID: b9a2e2e4c654b18e60725bc55a6a3754bc963e451acf320c2e7420e9f1d3aa01
Instruction ID: b6e0e817358a091974468e7adaedc076c3e46fc0117c532e15c918051c0b76fc
Opcode Fuzzy Hash: b9a2e2e4c654b18e60725bc55a6a3754bc963e451acf320c2e7420e9f1d3aa01
Instruction Fuzzy Hash: 0AF16675D446288BDB68CF19CC803C8B7B5BB59318FA981D9D88867385D774EEC18F81

Uniqueness

Uniqueness Score: -1.00%

Function 61E9F0ED Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 858COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E9F2E4

Strings

, xrefs: 61E9F16F

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-3916222277
Opcode ID: 652460d73263bdf4d719ca70a6f2cc424e75321fe8c6a35287bb2097d5c0c26c
Instruction ID: bfece18307556e4ef4cbbc35f99f21af59f03d97bd6a6be96c4aa07d47f44be4
Opcode Fuzzy Hash: 652460d73263bdf4d719ca70a6f2cc424e75321fe8c6a35287bb2097d5c0c26c
Instruction Fuzzy Hash: 9F82D375E04259CFDB04CFA8C580A8DBBF1BF88308F258569E859AB355D778E946CF80

Uniqueness

Uniqueness Score: -1.00%

Function 61EA70CF Relevance: 3.2, Strings: 1, Instructions: 1931COMMON

Download Yara Rule

Strings

d, xrefs: 61EA862E

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 9c9e38171c6603f8093b714fb000efb1f28052484ede3b556d4bca0120f0b4e8
Instruction ID: a6081b29965de0926bd1f9b116bef4fbec5f60393564f64626f3e1bb6397bda8
Opcode Fuzzy Hash: 9c9e38171c6603f8093b714fb000efb1f28052484ede3b556d4bca0120f0b4e8
Instruction Fuzzy Hash: 5823C374A04259CFDB60DFA8C884B8DBBF1BF88308F2585A9D888AB345D775D985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E31DAB Relevance: 3.1, Strings: 2, Instructions: 599COMMON

Download Yara Rule

Strings

?, xrefs: 61E31DE4
@, xrefs: 61E3231B

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: ?$@
API String ID: 0-1463999369
Opcode ID: 17282316eccadc5d136356c8655e5051220d6aaf7da56665674151cdb10d9dda
Instruction ID: eb37215bc7a8fd5f0b65b01ac5f6a00cefd0b4980fd33cabf8589fd9f13e8be8
Opcode Fuzzy Hash: 17282316eccadc5d136356c8655e5051220d6aaf7da56665674151cdb10d9dda
Instruction Fuzzy Hash: 11422734E0426A8BDB11CFA9C5807DDBBF1BF99314F248199D894AB391D335E986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 61E25FA2 Relevance: 3.1, Strings: 2, Instructions: 560COMMON

Download Yara Rule

Strings

BINARY, xrefs: 61E2613A
$va, xrefs: 61E261A4

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: $va$BINARY
API String ID: 0-1706479968
Opcode ID: 174683a009bcc6a4cbd855a3ac320b703f60fd0ea0e98f68b5225d26e58ec989
Instruction ID: 51ae49446533dd8fd2a3531cbcacbf2776eddcb6362a0c0b66c52bdc41a6a382
Opcode Fuzzy Hash: 174683a009bcc6a4cbd855a3ac320b703f60fd0ea0e98f68b5225d26e58ec989
Instruction Fuzzy Hash: 1B421375E05299CFDB10CF98C590A8DBBF1BF88314F248629E858AB395D374E846CF81

Uniqueness

Uniqueness Score: -1.00%

Function 61E62554 Relevance: 3.0, Strings: 2, Instructions: 459COMMON

Download Yara Rule

Strings

BINARY, xrefs: 61E62831, 61E62877, 61E628BA, 61E628D8
0, xrefs: 61E6283F

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: 0$BINARY
API String ID: 0-1556553403
Opcode ID: 9b720d48a7ff08584b00a733e1c7b0591028ec92d24130de9680df42adbd2a4f
Instruction ID: e60323d610b5e953cfa2bbac53d573cb4ccd773d83c01c1116e4164fd3caed25
Opcode Fuzzy Hash: 9b720d48a7ff08584b00a733e1c7b0591028ec92d24130de9680df42adbd2a4f
Instruction Fuzzy Hash: 5E22E1B4E0425A8FDB04CFA8D480A9DBBF1FF98314F658569E859AB355D734E842CF80

Uniqueness

Uniqueness Score: -1.00%

Function 61E8D0B6 Relevance: 2.7, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

BINARY, xrefs: 61E8D1D0, 61E8D1E5
9ua, xrefs: 61E8D1EA

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: 9ua$BINARY
API String ID: 0-3775120692
Opcode ID: 5952825176845502c0630c963f1cf7dda46f62ee53b696e1af0b9cc7c28b5bff
Instruction ID: a257fdc816b75983c87695270593668a71f4eb775f4fb4bb7c1b83965cb32a4b
Opcode Fuzzy Hash: 5952825176845502c0630c963f1cf7dda46f62ee53b696e1af0b9cc7c28b5bff
Instruction Fuzzy Hash: ED811978A0461A9FDB41CFA9D58079EBBF1BF88758F21C02AEC58AB354D774D841CB90

Uniqueness

Uniqueness Score: -1.00%

Function 61E7A790 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

4, xrefs: 61E7B364

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: b1c85b9edcee8372ad259f730a460971789aed980db87fee4e25cf3816e41443
Instruction ID: 518d6d0113e266a091a0cbf43dd9b6b92f5400263bfdc1a72100ca210d41eac5
Opcode Fuzzy Hash: b1c85b9edcee8372ad259f730a460971789aed980db87fee4e25cf3816e41443
Instruction Fuzzy Hash: E7C2D274A042598FEB20CFA8C490B9DBBF1BF89308F24C559E855AB390D774E886CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E98FE2 Relevance: 2.2, Strings: 1, Instructions: 993COMMON

Download Yara Rule

Strings

0, xrefs: 61E99C5F

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 1683cc5e6fcc29f367190e58bbfdda77c9789cfa2534cb2ac865ad9609eb6d8f
Instruction ID: b9cfdf9aff36692a2be4ad7309719c75a621d287fa98b86d1028b92f8662c608
Opcode Fuzzy Hash: 1683cc5e6fcc29f367190e58bbfdda77c9789cfa2534cb2ac865ad9609eb6d8f
Instruction Fuzzy Hash: 83A2F775A04229CFDB25CF68C890B99BBB1BB89304F2584D9D88DA7351DB30EE85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E9FBF0 Relevance: 1.7, APIs: 1, Instructions: 496COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61EA0137

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: f0e223f4e7dde77cf69cf17d1b16d38c815983f1c3fe0e1417d9e3426bf97463
Instruction ID: 797909e4487367ccd8785a7356e571bcdb88a46cf15c43a51895c5e5f409efd9
Opcode Fuzzy Hash: f0e223f4e7dde77cf69cf17d1b16d38c815983f1c3fe0e1417d9e3426bf97463
Instruction Fuzzy Hash: 8A32EF74A04259CFDB04CFA8C584B8DBBF1BF88318F25C56AE858AB355D774E846CB41

Uniqueness

Uniqueness Score: -1.00%

Function 61E40065 Relevance: 1.6, APIs: 1, Instructions: 349COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E4010A

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 82c5080adff732aa16026258a5585b3c81513096f7676642f0750af1a48823a4
Instruction ID: 5f607dce3bb248c7bc7ba639c908390524c363e3b0c88829d9203463054831df
Opcode Fuzzy Hash: 82c5080adff732aa16026258a5585b3c81513096f7676642f0750af1a48823a4
Instruction Fuzzy Hash: D4E12675A04209CFDB04CFA8D49069EBBF2BF98314F29856AEC54EB346D734E951CB90

Uniqueness

Uniqueness Score: -1.00%

Function 61E91DC1 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

'a, xrefs: 61E91FEE

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: 'a
API String ID: 0-1265788581
Opcode ID: ab7145635c82bd9b1b0131236768f0da4658b82cfd9f1350a3d2dada9f499ded
Instruction ID: 2a1e93e661ff6ac72fb5e1383ae7a1199ccbf3477a44a7f34e58db07055c9281
Opcode Fuzzy Hash: ab7145635c82bd9b1b0131236768f0da4658b82cfd9f1350a3d2dada9f499ded
Instruction Fuzzy Hash: 97C1E47490561A9FDB04DFA9C48069EBBF5BF98314F20C969E894AB304D730E885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 61E18736 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

h(a, xrefs: 61E18830

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: h(a
API String ID: 0-2400461097
Opcode ID: 5ee77b5fb974a29124882730f08498d74f86221d2b172790f955c6dba14d74d0
Instruction ID: f5bca11cc97640b6e875e2d2b4b9a879d1eb82f3f63dc60f1c56b61e4975c6c7
Opcode Fuzzy Hash: 5ee77b5fb974a29124882730f08498d74f86221d2b172790f955c6dba14d74d0
Instruction Fuzzy Hash: 6C91A03090C2918BEB05CEA8D4C2B59BBB2AF85308F6CC199DC499F38AC775D855D791

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D68C Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

bua, xrefs: 61E2D6C4

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID: bua
API String ID: 0-3993766197
Opcode ID: 633315b2ebd987899b0574c5a9c2535cb517164b27f88ba4281f08561b9dd3a8
Instruction ID: 2dbdb228c3cab7288b2b063f09620b15a0131b4afe136593b5dc23e7c01abf69
Opcode Fuzzy Hash: 633315b2ebd987899b0574c5a9c2535cb517164b27f88ba4281f08561b9dd3a8
Instruction Fuzzy Hash: BF112A74A0434A8FCB04CF6DC5C058ABBE4FF88265F248529ED48CB301D374E991CB91

Uniqueness

Uniqueness Score: -1.00%

Function 61EA91F6 Relevance: .9, Instructions: 922COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9c2de88e15720abfe36889467c93605a7d8ca8968bb05d13659a39059123bd
Instruction ID: 746819fbde02672c5e9b0b23433deca564a22272aedf92c5aa0001529aa1c472
Opcode Fuzzy Hash: 8e9c2de88e15720abfe36889467c93605a7d8ca8968bb05d13659a39059123bd
Instruction Fuzzy Hash: ABA2E6B4A043698FDB10DF68C88478DBBF1BF89308F2589A9D889AB344D775D985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61EA5B62 Relevance: .8, Instructions: 840COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db62365491715937999746577448bffa7923a641c61cf7b17e4a38164d9f0653
Instruction ID: a44220d8eda0408d574e55f09471a4b8d90abc40079a2b9137b2c96c3645ed57
Opcode Fuzzy Hash: db62365491715937999746577448bffa7923a641c61cf7b17e4a38164d9f0653
Instruction Fuzzy Hash: 3882E275A043598FDB50CFA9C880B8DBBF1BF89318F2585A9E858AB341D774E981CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E6904E Relevance: .8, Instructions: 834COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdee5f106130f9c003e98ff858ec0a85d67dd58a6e597a66ac0da64aa36c3f40
Instruction ID: 64511e9e7bc8a538c31c2dec79f9366059c8cda353a3f8e3c319e5c84b16a323
Opcode Fuzzy Hash: cdee5f106130f9c003e98ff858ec0a85d67dd58a6e597a66ac0da64aa36c3f40
Instruction Fuzzy Hash: A382EE74A442598FDB10DFA8C490B9EBBF6BF89308F60842DD899AB345DB74E845CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E9D0C3 Relevance: .6, Instructions: 639COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58010b9c1f0d999433e5b18c6f47566a29e3a6c5af20a6dc7c95a0469ad99757
Instruction ID: bf890a49f948a95996c0874b8a48064969d64c08d11fd484a8260e1bd552f906
Opcode Fuzzy Hash: 58010b9c1f0d999433e5b18c6f47566a29e3a6c5af20a6dc7c95a0469ad99757
Instruction Fuzzy Hash: 4062D2789052298BDB25CF58C9807C9B7F1BB49314F2589EAD848AB351D774EEC1CF90

Uniqueness

Uniqueness Score: -1.00%

Function 61E534E3 Relevance: .6, Instructions: 638COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b151c5699c924ba965d7e606cb673ecba401ccb569ae61ecce91f491f25524c2
Instruction ID: 9d8ba64b78ef50a58b18041be0aa597e26323e47a4c979711dc9b8f68f915d3c
Opcode Fuzzy Hash: b151c5699c924ba965d7e606cb673ecba401ccb569ae61ecce91f491f25524c2
Instruction Fuzzy Hash: C362D774A05269CFDBA0CF68C880B89B7B1BB48308F2585E9D84DAB345D731EE95CF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E55BD7 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2169874bd747550d2b124de943c030724899a2f04aac3c7e4c0cdb5ce11a48ea
Instruction ID: e0a500f3d695454715f18051163da62669697884006f913259c36ef59c383f1b
Opcode Fuzzy Hash: 2169874bd747550d2b124de943c030724899a2f04aac3c7e4c0cdb5ce11a48ea
Instruction Fuzzy Hash: 5042B070A052859FEB54CFA8C48479EBBF1BF88308F24C56DE8589B391C736D861CB91

Uniqueness

Uniqueness Score: -1.00%

Function 61E58670 Relevance: .6, Instructions: 613COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8978555ce2425aa3b3ddfa9e1e8d641089471ef8d0f3d36793c637034a778acd
Instruction ID: 7acb60ce99df90a8d4815b3c5ed6ca94b274d674d137866997d0d1df3706a504
Opcode Fuzzy Hash: 8978555ce2425aa3b3ddfa9e1e8d641089471ef8d0f3d36793c637034a778acd
Instruction Fuzzy Hash: 91525970A14269CFEBA4CF29C880B89B7B1BB49314F2481D9D84DAB342D731EE95DF51

Uniqueness

Uniqueness Score: -1.00%

Function 61E4CEF9 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33164d37dc1f8bc3c6465863d80b3bf23a647da6b8e1d50295bdad47704f48e9
Instruction ID: 19f4867394c01e4d8c9e316edce12a8cee81f65b8fdb4e74c3c7cf9959f5a621
Opcode Fuzzy Hash: 33164d37dc1f8bc3c6465863d80b3bf23a647da6b8e1d50295bdad47704f48e9
Instruction Fuzzy Hash: 19121678A0525ADFCB05CFA9E480A8DB7F1BF59318F21C165E815AB360D774EC82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 61E52F80 Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc2588524871c951a60f1b2fce8abbe6d5b26ae1e84268bc98c8063506949ee5
Instruction ID: d69fdf5d9c806f7edba15bc314e05e9f3cdc1a2150cd31b96f5dbe42976c28ee
Opcode Fuzzy Hash: cc2588524871c951a60f1b2fce8abbe6d5b26ae1e84268bc98c8063506949ee5
Instruction Fuzzy Hash: C8022674A05245CFDF49CFA8C590A9DBBF2AF88318F25C069E815AB345DB36E891CF50

Uniqueness

Uniqueness Score: -1.00%

Function 61E1DEC2 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0009230b87fc886eed7ce7e11b94bf72c1abcc1dc72f1cc9b19a1b34b6dec77d
Instruction ID: 4023b7f274c616fb69ecadc0a802b8025637675746aaadec300ab2c9a24e8e17
Opcode Fuzzy Hash: 0009230b87fc886eed7ce7e11b94bf72c1abcc1dc72f1cc9b19a1b34b6dec77d
Instruction Fuzzy Hash: A5D15F6291EE818FD70A8579C8662BDBFA2AF9A31472CC3ADE0534FBCDD128C545C711

Uniqueness

Uniqueness Score: -1.00%

Function 61E10856 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0cc950a9d611d45ec736ade90280dfb09da3b2b2986ef2fb50fd54848431665
Instruction ID: c10a399038eb35cab1d0fd47fbf04f5bffad08025378c4b9320364a8326b92cd
Opcode Fuzzy Hash: c0cc950a9d611d45ec736ade90280dfb09da3b2b2986ef2fb50fd54848431665
Instruction Fuzzy Hash: EBB1273390E6858AD7118DB8CC92289BB63AFD6318B3CC365E060CE3CDD274C55AD352

Uniqueness

Uniqueness Score: -1.00%

Function 61E37930 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 481b6b00b081b4320c04b5961dfb85ef1799ca06dd5eb79cfd6515449694c142
Instruction ID: 3210fe7c149a8df005d633ee7ab480dd5827b519719accc1fa5954128a221567
Opcode Fuzzy Hash: 481b6b00b081b4320c04b5961dfb85ef1799ca06dd5eb79cfd6515449694c142
Instruction Fuzzy Hash: 2591C371E44266CBEB199E98C8807597AF2ABC8348F35C5E9C45A9B351E771CD82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 61E1EEFF Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84af679267979af983d347aced72cd7cb6a196887476cf56ad9a17c6cbe7d888
Instruction ID: 878cb23af3a6350bf954d4178c5a2acd4654a5c4dc0d4d629278b81f8bee302c
Opcode Fuzzy Hash: 84af679267979af983d347aced72cd7cb6a196887476cf56ad9a17c6cbe7d888
Instruction Fuzzy Hash: C0C129B1A056488FDB04CFA9C88578EBBF1BF89304F148269D858DB35AD774D949CB81

Uniqueness

Uniqueness Score: -1.00%

Function 61E21816 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c858093c431b29f645a23dff97c23071af137f23373f22ae86f3e748476ba9
Instruction ID: ee4abaf29e25974d2c85c3f1aac93c3a2f37e56c7b47184ac1c003f272dee530
Opcode Fuzzy Hash: d5c858093c431b29f645a23dff97c23071af137f23373f22ae86f3e748476ba9
Instruction Fuzzy Hash: 4B917575E042598FDB05CFE8C8A069DBBF1BB89324F29C719E8A497380D731DA428B51

Uniqueness

Uniqueness Score: -1.00%

Function 2A22235C Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670894968.000000002A221000.00000040.00001000.00020000.00000000.sdmp, Offset: 2A221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a221000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be83580bfc2575eaacc6044e77c6e2ce9d29705b42a2534245aefe1a6cd5b78
Instruction ID: f0761fbd49b26a542cd08d360a3c21010c8142e85fc88d85bdfe866b2147296c
Opcode Fuzzy Hash: 7be83580bfc2575eaacc6044e77c6e2ce9d29705b42a2534245aefe1a6cd5b78
Instruction Fuzzy Hash: 826169B1B446027BF311AE38CC90F1BBB95EFD8704F558128F948B7386D636EA1187A0

Uniqueness

Uniqueness Score: -1.00%

Function 61E5023C Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad94163cbd485a3820f2b2698508bd4aff4105ea4421208451efe873d26d17a2
Instruction ID: 266643c6cdafb612aa4dcbeacb2f29c0698f44024270a5fd4dc4a93060dce87c
Opcode Fuzzy Hash: ad94163cbd485a3820f2b2698508bd4aff4105ea4421208451efe873d26d17a2
Instruction Fuzzy Hash: EC910631A012199FDB44CFA9D484A9EBBF2BF88358F25C129E818EB315E735EC51CB50

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D9B0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ab0d498e6869f1248f18525f82ea8c3addd781597051de19eda25eeb30940a
Instruction ID: 382c8684cf9a3560b476f3c0be3439e748f519b75ac4ebfb263bed86336ac9cf
Opcode Fuzzy Hash: 37ab0d498e6869f1248f18525f82ea8c3addd781597051de19eda25eeb30940a
Instruction Fuzzy Hash: 1A319EB8508755DBDB04DF58C4A06AABBF0FF89324F24C95EEAA84B351D334C451CB42

Uniqueness

Uniqueness Score: -1.00%

Function 61E15337 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87a3deadb9d58158e10bd0d13bb27e12a41fb1a60a956b8ee286a92c2821ca3b
Instruction ID: 28e1a2f4ec7288b6cc9663568d88951edc36634af267e108b581ab28c3048e35
Opcode Fuzzy Hash: 87a3deadb9d58158e10bd0d13bb27e12a41fb1a60a956b8ee286a92c2821ca3b
Instruction Fuzzy Hash: EE21D331A081098FD718CFAAC8D06DEB7F2EF9A304F25C039D815E7218E6B0E915CB60

Uniqueness

Uniqueness Score: -1.00%

Function 2A225B72 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670894968.000000002A221000.00000040.00001000.00020000.00000000.sdmp, Offset: 2A221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a221000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adff344794a757cc42752aaf151bf4080dc5f27db02630eec5a5f6fb8f4f3353
Instruction ID: aa482e532ffe50f134f8e437a8e24c73fb318f386a77a525daaea05950dd196d
Opcode Fuzzy Hash: adff344794a757cc42752aaf151bf4080dc5f27db02630eec5a5f6fb8f4f3353
Instruction Fuzzy Hash: 14116134A15A4A8FF764DF18EC59A04B3EAEB09331F59C2E6E94987357D3389D40DB40

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D781 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97cbfa6a907e55dae8401866b1d15889492c98cb2e246ce72649cc570ac47a2c
Instruction ID: 3be14e853f6d6f7a8a57e59baf3aa0a0bffb859339050ea86f3e3846f1c49e98
Opcode Fuzzy Hash: 97cbfa6a907e55dae8401866b1d15889492c98cb2e246ce72649cc570ac47a2c
Instruction Fuzzy Hash: 80012878A046559FCB00DFA9C4D095EBBF5FF89724B24C46AEA488B314C738E851CB92

Uniqueness

Uniqueness Score: -1.00%

Function 61E0B431 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba9cc90e5a21082ad6c2295b21ce38250c8b9c469be8e37a4c4f460e4ebd293f
Instruction ID: f77352582697cf63471e0c4c8f40e3a4f494cd20e5c99f7e715a2ca9bff404d5
Opcode Fuzzy Hash: ba9cc90e5a21082ad6c2295b21ce38250c8b9c469be8e37a4c4f460e4ebd293f
Instruction Fuzzy Hash: 4C01F93A904650CFC7009F65C4C0699BBB5FF85319F19C16ADC584F346D734D592CB91

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D714 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c3ebf914bd4d94a51e339c97bb43ea5b9a0e5b7f07c667420d66bd9099e7be
Instruction ID: 23c8173731f4f8750f7e82a0d5cf473f1c368e3d07a63e1643a5bca77f02800b
Opcode Fuzzy Hash: e0c3ebf914bd4d94a51e339c97bb43ea5b9a0e5b7f07c667420d66bd9099e7be
Instruction Fuzzy Hash: 18014B74A003469BD704DF6AC4C4A4AFBB4FF88368F14C669D8088B301D374E995CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 2A2210F9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670894968.000000002A221000.00000040.00001000.00020000.00000000.sdmp, Offset: 2A221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a221000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0cb571f043057fe9febfc1c58cba9e309ae6da326eefaf23432372124df1c7f
Instruction ID: 95b31b81ecd7946a83fab9201412cc9aa1f2ad23ef9bd904942def84d1490dbc
Opcode Fuzzy Hash: c0cb571f043057fe9febfc1c58cba9e309ae6da326eefaf23432372124df1c7f
Instruction Fuzzy Hash: 6FF08276B0093A9BE715EA55E840E42F396BBD82A0F118671C9044B709D670E9C6D9D1

Uniqueness

Uniqueness Score: -1.00%

Function 2A225B15 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670894968.000000002A221000.00000040.00001000.00020000.00000000.sdmp, Offset: 2A221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a221000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b54017ca1b216042ce32d40c0267898b1c635e98d5cffd7e0ffa5ac943036c5
Instruction ID: c5aad2f59a22615a9f4dc877060b523a23f3b3129fc6b5eee9cb61f5278a990e
Opcode Fuzzy Hash: 0b54017ca1b216042ce32d40c0267898b1c635e98d5cffd7e0ffa5ac943036c5
Instruction Fuzzy Hash: 33F0B476D00A09CFE768DF08D994B15B3E8EB14720F05C2BADE4A87B55D239EA40DA85

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D5E6 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 603a9ca93cbafb1f4181249a4d705fd8964dc025393484f8e9e5c12118581de5
Instruction ID: 683273e64459584920a51cd19a7e4d80a31ac76df9d38907cb404440e2cf26f0
Opcode Fuzzy Hash: 603a9ca93cbafb1f4181249a4d705fd8964dc025393484f8e9e5c12118581de5
Instruction Fuzzy Hash: BDF05E79A0020A9FCB00DF69D9C088EB7F9FF89224B24C065ED089B305D334E952CF91

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D595 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec887b937182efdeb275cf1860c59da708b12e60ecbd0d81ba91b53eac5727a
Instruction ID: 44e553df0f6153727c0ccd70e02d170a2b8fbf64feb92f11989a6743949971bc
Opcode Fuzzy Hash: fec887b937182efdeb275cf1860c59da708b12e60ecbd0d81ba91b53eac5727a
Instruction Fuzzy Hash: 64F08934604619DBCB00EF99EDC489EBBB4FF49264F10C495ED948B354DB30D86587D1

Uniqueness

Uniqueness Score: -1.00%

Function 2A222716 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670894968.000000002A221000.00000040.00001000.00020000.00000000.sdmp, Offset: 2A221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a221000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3747b216bb7640c08f949b015196ec800bea75b710efc7667a09099d45f6f0fe
Instruction ID: f38dcdd5fdfbb40ec46e60c90ff50b9ab115b947fd82d0702696fcb091b86439
Opcode Fuzzy Hash: 3747b216bb7640c08f949b015196ec800bea75b710efc7667a09099d45f6f0fe
Instruction Fuzzy Hash: 2BF0A0B7680A098BE324CE11E880A03F3A6BB98660F118261CD081B702C530FDC2C6D0

Uniqueness

Uniqueness Score: -1.00%

Function 2A225ACD Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670894968.000000002A221000.00000040.00001000.00020000.00000000.sdmp, Offset: 2A221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a221000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d67282a457da30ecbb40882b3a9bdb813fe659884c447fe35482e18ecf4b2767
Instruction ID: 44ff7cae10eacd741471e2646fc8176606dd24d6320413494bfaee65bac0ff3b
Opcode Fuzzy Hash: d67282a457da30ecbb40882b3a9bdb813fe659884c447fe35482e18ecf4b2767
Instruction Fuzzy Hash: 99E06572A41616CBD718EF84E880982F728FB4436071182A2DD049B706C338FD81CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 61E1307A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14736fa9179efb67357d4d22b433410e97ebfd633caaa68a2b1c40438b902975
Instruction ID: 20361dabe9e5e624aead0c2cbcda463e1dc5d30ecc087adce6a46ccbc9e5f0dc
Opcode Fuzzy Hash: 14736fa9179efb67357d4d22b433410e97ebfd633caaa68a2b1c40438b902975
Instruction Fuzzy Hash: 01F01C310186858BD7098B689466BA0BFE4AB02328F28C7F9E86D0F7D7C67195C4C790

Uniqueness

Uniqueness Score: -1.00%

Function 61E158CA Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb0f00a4b6ce43e1eafe55f13756f77eaeb3198e66c972334d9a781409f15c7
Instruction ID: 77dbb67e5b13935fb998f7bdeac757b62f4bcf2f309577294fbba61f324934a3
Opcode Fuzzy Hash: 6fb0f00a4b6ce43e1eafe55f13756f77eaeb3198e66c972334d9a781409f15c7
Instruction Fuzzy Hash: 6CE0EC363493485FFB40C9AAADC0A66B79AEB8D12CB24C236ED188B309D522D85146A0

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D945 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6dac371d744d1f4a74433f500022962c81eca0c7d3a4d374c1a06fb4a0a0243
Instruction ID: 49fe5c7db6ee1c100769216236de79f0150f8c1617bfc082eb282041d978b41e
Opcode Fuzzy Hash: f6dac371d744d1f4a74433f500022962c81eca0c7d3a4d374c1a06fb4a0a0243
Instruction Fuzzy Hash: A4F04EB9A4535D9FDB00CF0AD8C1ADABBA8FB0C260F94811AFE1857341C274A9508BE1

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D65B Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80444b7a1f9c336b8ddf7ede844ef2572c4fef74faff3e978b08c37b414cddcf
Instruction ID: 214e4a77422a75c172c9c2064a368b9d1fba0603b708cc731de69edf92eb1139
Opcode Fuzzy Hash: 80444b7a1f9c336b8ddf7ede844ef2572c4fef74faff3e978b08c37b414cddcf
Instruction Fuzzy Hash: EEE0E678A042495FDB00DF65D4C054AB7B5FF48258B24C165DD484B305D231E995CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 2A222F9E Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670894968.000000002A221000.00000040.00001000.00020000.00000000.sdmp, Offset: 2A221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a221000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0097000110ca4480fda5f1152f7199adb4e918a11b06752da7ac39026022d07e
Instruction ID: 016f392f6034dc8dea31da8d015a5c6bca05ff7e38bbce8e74b402d42617ac44
Opcode Fuzzy Hash: 0097000110ca4480fda5f1152f7199adb4e918a11b06752da7ac39026022d07e
Instruction Fuzzy Hash: 5ED01261068602F6D325DF10E8C1BC9F753AB59740FA58508D10403318E33A95248B43

Uniqueness

Uniqueness Score: -1.00%

Function 2A2233C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670894968.000000002A221000.00000040.00001000.00020000.00000000.sdmp, Offset: 2A221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a221000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 030f45737306472040fd804f08ade6ffa5201275c9961ef35cd96cc10e73d93a
Instruction ID: cdf729c095d7f498491cf17c56da5312fde40995034eead580cf1e22a14a2b33
Opcode Fuzzy Hash: 030f45737306472040fd804f08ade6ffa5201275c9961ef35cd96cc10e73d93a
Instruction Fuzzy Hash: 6FD05E79210900CFE312DBB8CA45F19F7A8FB4E220FA494E0F845DB322CD24DA009990

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D981 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7741dc5002cb162032dfd22e15b2f11181b9a78a06ce5ec405677c32640a3b74
Instruction ID: 0770371ec9a44e43cdd5cf4ef26b08e67e6dab9ce041578c4bbee247c5ef0355
Opcode Fuzzy Hash: 7741dc5002cb162032dfd22e15b2f11181b9a78a06ce5ec405677c32640a3b74
Instruction Fuzzy Hash: 54E0B6B550531DAFCB00CF09D8849CABBA8FB08260F10811AFD145B301C371E910CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D916 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b9b301cd6fe802102ace05a8f3f54127e45f3cfeb9e9c857c71b75d53a3f46
Instruction ID: 945e16ab1c4606d0450c898c0f973b63cf6ac8bb22533ea61b57455de4454874
Opcode Fuzzy Hash: 84b9b301cd6fe802102ace05a8f3f54127e45f3cfeb9e9c857c71b75d53a3f46
Instruction Fuzzy Hash: B1E0B6B550531DAFCB00CF09D8809CABBA8FB08364F10811AFD145B301C371E950CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D8E7 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bebc2205bf665d9e62f953e7dddfa37ec45d91e25232bda72014aaaf6124a9de
Instruction ID: 3559d1c802e24a9b256d38bd1c0691e015ce79746017865ea9437725e8f07286
Opcode Fuzzy Hash: bebc2205bf665d9e62f953e7dddfa37ec45d91e25232bda72014aaaf6124a9de
Instruction Fuzzy Hash: DCE002B950535DAFDB00CF09D894ADABBA8FB09264F50811AFD1857301C375E961CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D8B8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc46c8122d7ec2c0d3e85d99e06002b58141c25f7dac85a939e33f12ea64f0c
Instruction ID: 0c6bb8ec670fbf06178dafeec3c5f151ae9a42d8b6ea8cc00f9de22d3b6fc0e1
Opcode Fuzzy Hash: 4bc46c8122d7ec2c0d3e85d99e06002b58141c25f7dac85a939e33f12ea64f0c
Instruction Fuzzy Hash: 83E0B6B550531DAFCB00CF09D880ACABBA8FB08260F10811AFD145B300C371E910CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 61E2D635 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce01ef94e47e0f3b5e3022edffbc238ed3a861089da3a055ee794e226609d537
Instruction ID: e794d2b72a1fc6c6090aef49fcd2ae8b4ab6f64d521491744c60cc3bf2b3839a
Opcode Fuzzy Hash: ce01ef94e47e0f3b5e3022edffbc238ed3a861089da3a055ee794e226609d537
Instruction Fuzzy Hash: 8ED092B8909349AFCB00EF29C48544EBBE4BF88258F40C82DFC98C7311E274E8408F92

Uniqueness

Uniqueness Score: -1.00%

Function 61E038DC Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40af0c36dbf5a0f884e18cc3b6e49f381d70d038c9458a678f14876bb3249447
Instruction ID: 5d8a4dcf50b240acca679c383b9083a7302e11f974503154b2c6ec1cc823b236
Opcode Fuzzy Hash: 40af0c36dbf5a0f884e18cc3b6e49f381d70d038c9458a678f14876bb3249447
Instruction Fuzzy Hash: D9C01230244308CFEB40CAAED480A62B3E9BB44A24F50C0A0E808CB340DA30F9118690

Uniqueness

Uniqueness Score: -1.00%

Function 2A226480 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670894968.000000002A221000.00000040.00001000.00020000.00000000.sdmp, Offset: 2A221000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a221000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
Instruction ID: 58c6f5837427d6eca2c2deaad74ce6c6656098581891570576efec04afcca601
Opcode Fuzzy Hash: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
Instruction Fuzzy Hash: 42D001392A1A48CFC241CF4CD084E40B3F8FB0DA20B068092FA0A8BB32C334FC00DA80

Uniqueness

Uniqueness Score: -1.00%

Function 61E038CA Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40cad0428ba2cec2f3835856280400d4fd42dbc754fd2a6d6e7cded720f8f0bd
Instruction ID: 67d68dba2000bb8482a24fc023f268fc16b477c73c548bd02e1b99648bc578f6
Opcode Fuzzy Hash: 40cad0428ba2cec2f3835856280400d4fd42dbc754fd2a6d6e7cded720f8f0bd
Instruction Fuzzy Hash: C9B09B2071430D565708CE549440977779DB784905724C455D81C85505E735E59152D0

Uniqueness

Uniqueness Score: -1.00%

Function 61E037F3 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c758f56ce800b0edb1a3b6b4920dd8d203c929418ffadd695cc457fe8d80d330
Instruction ID: de6271d013a038b850d850acc4260bf908e6486e870890920c4c51f453ae2ee2
Opcode Fuzzy Hash: c758f56ce800b0edb1a3b6b4920dd8d203c929418ffadd695cc457fe8d80d330
Instruction Fuzzy Hash: C7B0123B11030CCB4700DD0DD441CC1B3D8F708E127C104D0E41087701D669F800C685

Uniqueness

Uniqueness Score: -1.00%

Function 61E0FD8A Relevance: 30.3, APIs: 13, Strings: 7, Instructions: 320COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FDAF
memcmp.MSVCRT ref: 61E0FE00
memcmp.MSVCRT ref: 61E10580

Strings

ance, xrefs: 61E103AD
iti, xrefs: 61E105FC
ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ize, xrefs: 61E1065C
ate, xrefs: 61E105D5
ence, xrefs: 61E103D4

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: 9706f2438f5f9958a9f504a1a89414024658d7dc0fe24dd8d85b57cc53bebf8a
Instruction ID: 14175bb5b9193900e4a9b0b479f9e4e43aad601f0e58a5cb96228bda6cff1173
Opcode Fuzzy Hash: 9706f2438f5f9958a9f504a1a89414024658d7dc0fe24dd8d85b57cc53bebf8a
Instruction Fuzzy Hash: D0D127B0E09306CBDB01DF94C58269EBBF4AF85348F31C81AD8909B354D779D9668B92

Uniqueness

Uniqueness Score: -1.00%

Function 61E0FFDF Relevance: 28.8, APIs: 12, Strings: 7, Instructions: 293COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E10004
memcmp.MSVCRT ref: 61E10036
memcmp.MSVCRT ref: 61E1006E
memcmp.MSVCRT ref: 61E101F8
memcmp.MSVCRT ref: 61E103BB
memcmp.MSVCRT ref: 61E10580
memcmp.MSVCRT ref: 61E10669
memcmp.MSVCRT ref: 61E1070B

Strings

ance, xrefs: 61E103AD
iti, xrefs: 61E105FC
ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ize, xrefs: 61E1065C
ate, xrefs: 61E105D5
ence, xrefs: 61E103D4

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: b669a7a1187de0fce9b6595f66bcea219431e2422beeabc80f0d4f1047ca061f
Instruction ID: 8af95de5a1172c954fa437990dc91da2b279e7fac1ed370a937824a3edc9c215
Opcode Fuzzy Hash: b669a7a1187de0fce9b6595f66bcea219431e2422beeabc80f0d4f1047ca061f
Instruction Fuzzy Hash: EFC137B0E0C3068BDB009F94C58269EBBF4AF85348F31C81EE894DB754D779D5A68B52

Uniqueness

Uniqueness Score: -1.00%

Function 61E0FEFD Relevance: 27.3, APIs: 11, Strings: 7, Instructions: 287COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FF1E
memcmp.MSVCRT ref: 61E0FF6B
memcmp.MSVCRT ref: 61E0FFB2
memcmp.MSVCRT ref: 61E10580

Strings

ance, xrefs: 61E103AD
iti, xrefs: 61E105FC
ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ize, xrefs: 61E1065C
ate, xrefs: 61E105D5
ence, xrefs: 61E103D4

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: ed99b8ed2c93518955057c8a185e88c665ba01599eeeff3c7ab09e33224a8f47
Instruction ID: 3235e3b978ee00cfabdc0942405c464718558a8f08fb1430455de202698b3b76
Opcode Fuzzy Hash: ed99b8ed2c93518955057c8a185e88c665ba01599eeeff3c7ab09e33224a8f47
Instruction Fuzzy Hash: 1EC127B0D083068BDB00DF94C58269EBBF4AF85348F31C81ED890DB754D779D9A68B92

Uniqueness

Uniqueness Score: -1.00%

Function 61E100D7 Relevance: 27.3, APIs: 11, Strings: 7, Instructions: 280COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E100FC
memcmp.MSVCRT ref: 61E10131
memcmp.MSVCRT ref: 61E10580

Strings

ance, xrefs: 61E103AD
iti, xrefs: 61E105FC
ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ize, xrefs: 61E1065C
ate, xrefs: 61E105D5
ence, xrefs: 61E103D4

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: 5306eb8679e29c7ccae58c152c61b3cb2e43ab0ad82d1b8259ffa351aff7fd54
Instruction ID: a6745917a23cee73da34d97950539bfd860ce037a133a9b2c34405b562b65f13
Opcode Fuzzy Hash: 5306eb8679e29c7ccae58c152c61b3cb2e43ab0ad82d1b8259ffa351aff7fd54
Instruction Fuzzy Hash: 90C127B0E083068BDB00DF94C58669EBBF4AF85348F31C81ED890DB754D779D5A68B92

Uniqueness

Uniqueness Score: -1.00%

Function 61E0FBCF Relevance: 25.8, APIs: 10, Strings: 7, Instructions: 268COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FBF0
memcmp.MSVCRT ref: 61E0FC37
memcmp.MSVCRT ref: 61E10580

Strings

ance, xrefs: 61E103AD
iti, xrefs: 61E105FC
ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ize, xrefs: 61E1065C
ate, xrefs: 61E105D5
ence, xrefs: 61E103D4

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: e540365b7fd7f9443dd82ee147f8b9093e47f334e53584792075e5945152a348
Instruction ID: 60f9232e79ba8c46656df14b30f4429a15bc78d1e5e1648a3d40d26d176db9d4
Opcode Fuzzy Hash: e540365b7fd7f9443dd82ee147f8b9093e47f334e53584792075e5945152a348
Instruction Fuzzy Hash: 6EB128B0D0D3068BDB00CF94C58669EBBF4AF85348F31C81AD890DB754D779D9A68B92

Uniqueness

Uniqueness Score: -1.00%

Function 61E0FC61 Relevance: 25.8, APIs: 10, Strings: 7, Instructions: 259COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FC86
memcmp.MSVCRT ref: 61E0FCBF
memcmp.MSVCRT ref: 61E10580

Strings

ance, xrefs: 61E103AD
iti, xrefs: 61E105FC
ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ize, xrefs: 61E1065C
ate, xrefs: 61E105D5
ence, xrefs: 61E103D4

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: 0a817a664abe7669e1f9b819d607d3cf4ee08d2d7d4e2fd3f7bc486b0ed951a3
Instruction ID: 2b4bda0a5a7416114e6a254efe1c2f62446bd14a06bd16ad799116575b7de764
Opcode Fuzzy Hash: 0a817a664abe7669e1f9b819d607d3cf4ee08d2d7d4e2fd3f7bc486b0ed951a3
Instruction Fuzzy Hash: 03B126B0D0C3068BDB00DF94C58269EBBF4AF85348F31C81AD890DB754D779D9A68B92

Uniqueness

Uniqueness Score: -1.00%

Function 61E0FD37 Relevance: 24.2, APIs: 9, Strings: 7, Instructions: 248COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FD5C
memcmp.MSVCRT ref: 61E101F8
memcmp.MSVCRT ref: 61E103BB
memcmp.MSVCRT ref: 61E10580
memcmp.MSVCRT ref: 61E10669
memcmp.MSVCRT ref: 61E1070B

Strings

ance, xrefs: 61E103AD
iti, xrefs: 61E105FC
ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ize, xrefs: 61E1065C
ate, xrefs: 61E105D5
ence, xrefs: 61E103D4

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: c54270305458f61258e2551f56d469756e9d85375da6b675864f5ba64181ee46
Instruction ID: c635636e61c9daa50d7aef90f17bbd02a00a8acd362d6d180f064c5e09d29bb5
Opcode Fuzzy Hash: c54270305458f61258e2551f56d469756e9d85375da6b675864f5ba64181ee46
Instruction Fuzzy Hash: B0A126B0D0C306CBDB00CF94C58669EBBF4AB85348F31C81AD894DB754D779D9A68B92

Uniqueness

Uniqueness Score: -1.00%

Function 61E0FCE9 Relevance: 24.2, APIs: 9, Strings: 7, Instructions: 248COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FD0E
memcmp.MSVCRT ref: 61E101F8
memcmp.MSVCRT ref: 61E103BB
memcmp.MSVCRT ref: 61E10580
memcmp.MSVCRT ref: 61E10669
memcmp.MSVCRT ref: 61E1070B

Strings

ance, xrefs: 61E103AD
iti, xrefs: 61E105FC
ive, xrefs: 61E1063A
ous, xrefs: 61E10618
ize, xrefs: 61E1065C
ate, xrefs: 61E105D5
ence, xrefs: 61E103D4

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: c1250c06479d443b50863cfaca24b1a96d4c7a6c86a02d8b32de734b66d4155d
Instruction ID: 52be5bc32e4a241d7d631e7d354cb647d2df2ea9c6509ea900c66bb21baa7349
Opcode Fuzzy Hash: c1250c06479d443b50863cfaca24b1a96d4c7a6c86a02d8b32de734b66d4155d
Instruction Fuzzy Hash: 9DA127B0D0C306CBDB00DF94C58669EBBF4AB85348F31C81AD890DB754D779D9A68B92

Uniqueness

Uniqueness Score: -1.00%

Function 61E970B9 Relevance: 16.9, APIs: 1, Strings: 10, Instructions: 447COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E97281

Part of subcall function 61E0AE03: free.MSVCRT ref: 61E0AE3D

Strings

AND , xrefs: 61E97604
WHERE , xrefs: 61E97357
bua, xrefs: 61E97368
UPDATE main., xrefs: 61E9730B
IS ?, xrefs: 61E975EC
idx IS CASE WHEN length(?4)=0 AND typeof(?4)='blob' THEN NULL ELSE ?4 END , xrefs: 61E975CB
SET , xrefs: 61E9732E
= ?, xrefs: 61E97571
sqlite_stat1, xrefs: 61E97504
bua, xrefs: 61E9733E

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: freememcmp
String ID: = ?$ AND $ IS ?$ SET $ WHERE $UPDATE main.$bua$bua$idx IS CASE WHEN length(?4)=0 AND typeof(?4)='blob' THEN NULL ELSE ?4 END $sqlite_stat1
API String ID: 1183899719-1341641573
Opcode ID: b86365f922c0d80dc9959b963b1a5d42ddbc3d3dcbe52cbd35ddb153b41ba2b7
Instruction ID: 0d5b731b4e6e71452f02b40a28acc7cf76705435dae47c5a45c9821af7cd2139
Opcode Fuzzy Hash: b86365f922c0d80dc9959b963b1a5d42ddbc3d3dcbe52cbd35ddb153b41ba2b7
Instruction Fuzzy Hash: AE12E774E04259DBDB04CF98D480A9DBBF2BF88308F25C869E855AB351D774E886CF81

Uniqueness

Uniqueness Score: -1.00%

Function 61E3C943 Relevance: 16.9, APIs: 3, Strings: 8, Instructions: 360stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 61E3CC03
strncmp.MSVCRT ref: 61E3CC58
strncmp.MSVCRT ref: 61E3CCA9

Strings

], xrefs: 61E3CDC5
-, xrefs: 61E3CD00
}, xrefs: 61E3CDBB
-, xrefs: 61E3CCF0
0, xrefs: 61E3CCF9
null, xrefs: 61E3CBF8
true, xrefs: 61E3CC4D
false, xrefs: 61E3CC9E

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: strncmp
String ID: -$-$0$]$false$null$true$}
API String ID: 1114863663-1443276563
Opcode ID: 4366ec816b9fce7022b57502cc8f689d133e39cff5fe7996cab8ff7cfed47eb1
Instruction ID: 7d0d7d581299a88f4ecf4101ed3cb2921062378b47abb911dec42016596cbabc
Opcode Fuzzy Hash: 4366ec816b9fce7022b57502cc8f689d133e39cff5fe7996cab8ff7cfed47eb1
Instruction Fuzzy Hash: 4BD1DF70B482768ADB12CFA8C4443DABBF2AFCA318F69C25BD4919B281D739D446C751

Uniqueness

Uniqueness Score: -1.00%

Function 61E44905 Relevance: 13.8, APIs: 6, Strings: 3, Instructions: 346COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E44953
memcmp.MSVCRT ref: 61E44A05
memcmp.MSVCRT ref: 61E44BC9
memcmp.MSVCRT ref: 61E44C16
memcmp.MSVCRT ref: 61E44C7A
memcmp.MSVCRT ref: 61E44CAE

Strings

cache, xrefs: 61E44CA7, 61E44CC5
access, xrefs: 61E44BE0
@, xrefs: 61E44922

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID: @$access$cache
API String ID: 1475443563-1361544076
Opcode ID: d5536d11e1446137f876ee1720edd4e4232c55533b5c63909df9ac41a168e106
Instruction ID: bf7f6bc55254c54d21197c9aa673ce015ae0bdc4e4658c964804263f7089fac0
Opcode Fuzzy Hash: d5536d11e1446137f876ee1720edd4e4232c55533b5c63909df9ac41a168e106
Instruction Fuzzy Hash: FDD16FB4A083558FEB11CFA4D48039EBBF1AF89318F28C45ED895AB341E339D841DB55

Uniqueness

Uniqueness Score: -1.00%

Function 61E241D7 Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 180stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E24268

Strings

program, xrefs: 61E24457
bua, xrefs: 61E24252
(blob), xrefs: 61E2439F
Xya, xrefs: 61E24418
NULL, xrefs: 61E243A4
ya, xrefs: 61E2427F
ya, xrefs: 61E2429A
bua, xrefs: 61E24274

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: strcmp
String ID: ya$ya$(blob)$NULL$Xya$bua$bua$program
API String ID: 1004003707-2454903709
Opcode ID: a6b2441489b3eea19d207b247f0247f0001f19373451080d8235a064463bd687
Instruction ID: 4befd86826370bfd8630e1afa8d422750160e2b9b2ea18a9ced5634f5bcee847
Opcode Fuzzy Hash: a6b2441489b3eea19d207b247f0247f0001f19373451080d8235a064463bd687
Instruction Fuzzy Hash: 3B7115B49097469FC708CF58C191A59BBF0BF8A304F25C85EE8A89B751D335D882CF92

Uniqueness

Uniqueness Score: -1.00%

Function 61EAFA90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109filememoryCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61EAFABB
vfprintf.MSVCRT ref: 61EAFAD7
abort.MSVCRT ref: 61EAFADC
VirtualQuery.KERNEL32 ref: 61EAFB80
VirtualProtect.KERNEL32 ref: 61EAFBC2

Strings

@, xrefs: 61EAFBAB

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: Virtual$ProtectQueryabortfwritevfprintf
String ID: @
API String ID: 1503958624-2766056989
Opcode ID: c2659c9de0e6f83528643800fc17f210c5c049cf07d0f7c16b155af3332bfc43
Instruction ID: e02739713456e9e2b4b58c9f61bb7aa4e21306e92e7ace3c3799b12748f41957
Opcode Fuzzy Hash: c2659c9de0e6f83528643800fc17f210c5c049cf07d0f7c16b155af3332bfc43
Instruction Fuzzy Hash: 9A412AB1A547029FD700DF68D58464ABBF0FB89758F64C92DE8A98B340E734E884CB52

Uniqueness

Uniqueness Score: -1.00%

Function 61E01040 Relevance: 10.6, APIs: 7, Instructions: 132sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,61E012DC), ref: 61E01077
_amsg_exit.MSVCRT ref: 61E010A4

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: a124d45cb5394699c2ab659ebe120ec1ccf49b51c805edf607fecf4702c5277b
Instruction ID: a154691f748ef5392a7e4955094c5928503ae470ce452f5208c2c148eeae8840
Opcode Fuzzy Hash: a124d45cb5394699c2ab659ebe120ec1ccf49b51c805edf607fecf4702c5277b
Instruction Fuzzy Hash: 13414F71B146818FEB00AFE8C98470BB7F1EB85399F64C53DE4A48B344D775D9918B82

Uniqueness

Uniqueness Score: -1.00%

Function 61E01440 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 61E01456
GetProcAddress.KERNEL32 ref: 61E01471

Strings

_Jv_RegisterClasses, xrefs: 61E01466
libgcj-16.dll, xrefs: 61E0144F

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-16.dll
API String ID: 1646373207-328863460
Opcode ID: 659acb1d45e1fe859de50aa712dc5e6a1f27a03cf8697e99cf940ea6467707a5
Instruction ID: ecefe885db533eab1004145bf0edfd2de441c317d2227bbbfd891c436449bb9f
Opcode Fuzzy Hash: 659acb1d45e1fe859de50aa712dc5e6a1f27a03cf8697e99cf940ea6467707a5
Instruction Fuzzy Hash: CBE06DB4914B029BEB017FF4850633EBAF5AFC570AF72C42CD4808A290EA30C4818763

Uniqueness

Uniqueness Score: -1.00%

Function 61E3720A Relevance: 6.4, APIs: 3, Strings: 1, Instructions: 359COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E373CE
memcmp.MSVCRT ref: 61E37560
memcmp.MSVCRT ref: 61E37690

Strings

0, xrefs: 61E3767C

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID: 0
API String ID: 1475443563-4108050209
Opcode ID: ee72bea6c10e4d6b48cf337b5d82551d333533315d2e2aca538cef0d56a0c932
Instruction ID: 3f20ce3ba2961136da7f3248cde08971803f4c449cb9daae0617fd169a942f67
Opcode Fuzzy Hash: ee72bea6c10e4d6b48cf337b5d82551d333533315d2e2aca538cef0d56a0c932
Instruction Fuzzy Hash: 6CE112B0E04269CBDB41CFA8C99078DBBF1BF89318F258569D859AB345D734E886CF41

Uniqueness

Uniqueness Score: -1.00%

Function 61E40BB5 Relevance: 6.4, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E40C37
memcmp.MSVCRT ref: 61E40C5C
memcmp.MSVCRT ref: 61E40C86
memcmp.MSVCRT ref: 61E40CB5
memcmp.MSVCRT ref: 61E40CE1

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8cc521fb16cdd100886a572f5b312f8a70bae0a598922c27761b03018ed4fb84
Instruction ID: fd79a925e1d847c1357e69ee8e74f21d123acc92255d85b94bee504056160bb0
Opcode Fuzzy Hash: 8cc521fb16cdd100886a572f5b312f8a70bae0a598922c27761b03018ed4fb84
Instruction Fuzzy Hash: C0414EB0A083058BE7049FA9D68439EBAF5EFD5358F25C83DE898CB384D775D4458B42

Uniqueness

Uniqueness Score: -1.00%

Function 61E3D021 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 293stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 61E3D129

Strings

], xrefs: 61E3D302
-, xrefs: 61E3D2AF
#, xrefs: 61E3D24E

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: strncmp
String ID: #$-$]
API String ID: 1114863663-3149169660
Opcode ID: f99a3957d435e7ea3bb32a2a14cb1bf4f5c1a1f05ad08d6a5497aa7015d5eb71
Instruction ID: 1c490b0b60c0b5d90f91e160a7bf365b8f8ab346ded86ed4ccdc7e106188df17
Opcode Fuzzy Hash: f99a3957d435e7ea3bb32a2a14cb1bf4f5c1a1f05ad08d6a5497aa7015d5eb71
Instruction Fuzzy Hash: 82D15774D082698BDB01CF98C18479DFBF2BF89748FA9C059D854AB292D335E986CF50

Uniqueness

Uniqueness Score: -1.00%

Function 61EAF6D0 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 61EAF6F5
__dllonexit.MSVCRT ref: 61EAF733
_unlock.MSVCRT ref: 61EAF763
_onexit.MSVCRT ref: 61EAF777

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: __dllonexit_lock_onexit_unlock
String ID:
API String ID: 209411981-0
Opcode ID: 14a068eb5279b83cbe249a705044353e42ef401f74677ddee49b1cb2808ff91a
Instruction ID: d8116788f2c50d2f41c70b1de34e9b41b7999a481f31fa547576aa82505b99b8
Opcode Fuzzy Hash: 14a068eb5279b83cbe249a705044353e42ef401f74677ddee49b1cb2808ff91a
Instruction Fuzzy Hash: 7D1155B5A197418FCB40EF74D48455EBBE0AB89254F618D2EE4E5CB350E738D5848B82

Uniqueness

Uniqueness Score: -1.00%

Function 61EAFAF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 61EAFB80
VirtualProtect.KERNEL32 ref: 61EAFBC2

Strings

@, xrefs: 61EAFBAB

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: @
API String ID: 1027372294-2766056989
Opcode ID: 291e62d0b65acdb3804ba4f4353593b383c4c3d38d689e226719f6992fe71c3d
Instruction ID: d36ff6d444c1f5105915669b8fb698cf4239ff4a3251c649fd02843d9bfa6c4b
Opcode Fuzzy Hash: 291e62d0b65acdb3804ba4f4353593b383c4c3d38d689e226719f6992fe71c3d
Instruction Fuzzy Hash: C0316DB2A447018FE710DF68D99464AFBF0FB44358F55C92DD8A98B340E734E844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 61EAFEE0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 61EAFEEE
TlsGetValue.KERNEL32 ref: 61EAFF15
GetLastError.KERNEL32 ref: 61EAFF1C
LeaveCriticalSection.KERNEL32 ref: 61EAFF3C

Memory Dump Source

Source File: 00000000.00000002.1679060356.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000000.00000002.1679029833.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679437133.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679467307.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679528779.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679557946.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679586624.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1679631178.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61e00000_all the necessary information.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: a187a0561b15ac659cc27c31303386dc53fb4f2523cc2de19bd987d58d59314a
Instruction ID: 3c942bbf6517c0ec0331f125ad054bd991ea38a51cb55fe1ac34f487ea1a944f
Opcode Fuzzy Hash: a187a0561b15ac659cc27c31303386dc53fb4f2523cc2de19bd987d58d59314a
Instruction Fuzzy Hash: C0F081B6A016008FDB00BFB9A98951A7BA8EB46A44B19416CD9548B309D730E885CBE3

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report all the necessary information.scr

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKFIDHDGIEGCAKFIIJKF

C:\ProgramData\BGHCGCAE

C:\ProgramData\FCAAEHJDBKJJKFHJEBKFBGDAAE

C:\ProgramData\HCAFIJDGHCBFHJKFCGIEBGIIJD

C:\ProgramData\IDBAKKEC

C:\ProgramData\IIJKJDAF

C:\ProgramData\KJEHCGDB

C:\ProgramData\KJJJJDHIDBGHIDHIDAFB

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\sqlite3[1].dll

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
all the necessary information.scr

Function 61EAD2AC Relevance: 6.6, Strings: 5, Instructions: 334
COMMON

Function 61E354D1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31
COMMON

Function 61E4B8A1 Relevance: 1.6, APIs: 1, Instructions: 323
COMMON

Function 61E4C7C5 Relevance: 8.0, APIs: 4, Strings: 1, Instructions: 467
COMMON

Function 61E4928D Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 309
fileCOMMON

Function 61E33F01 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106
fileCOMMON

Function 2A2263C5 Relevance: 3.0, APIs: 2, Instructions: 42
fileCOMMON

Function 61E2A652 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON